syzbot

map[DenialOfService:false Explanation:Based on the analysis of the bug report and the ext4 source code, here is the
assessment of the security impact:

**Analysis:**
The bug is a **lockdep false positive** caused by slab object reuse without
re-initializing the lockdep class.

1. Ext4 inodes are allocated from `ext4_inode_cachep`, which uses a slab
constructor (`init_once`) to initialize the `i_data_sem` rw_semaphore.
2. When an inode is used to store large extended attributes (an EA inode),
`ext4_xattr_inode_set_class()` is called, which changes the lockdep subclass of
`i_data_sem` to `3` (`I_DATA_SEM_EA`).
3. When the EA inode is deleted and its slab object is freed, the lockdep
subclass remains `3`. If this slab object is subsequently reallocated for a
*normal* file, its `i_data_sem` incorrectly retains subclass `3` because
`ext4_alloc_inode()` does not re-initialize the semaphore.
4. When an unprivileged user unlinks this normal file, `do_unlinkat()` acquires
the parent directory's `inode_lock` (which uses subclass `1`, `I_MUTEX_PARENT`).
It then drops the last reference to the file, triggering `ext4_evict_inode()` ->
`ext4_truncate()`.
5. `ext4_truncate()` acquires the file's `i_data_sem` (which is still subclass
`3`). This establishes a lockdep dependency: **subclass 1 -> subclass 3**.
6. During truncation, `ext4_try_to_expand_extra_isize()` may be called, which
creates a *new* EA inode. Creating the EA inode acquires its `inode_lock`, which
is explicitly assigned subclass `1` by `ext4_xattr_inode_set_class()`. This
establishes the reverse dependency: **subclass 3 -> subclass 1**.

Lockdep detects this cycle and emits a WARNING. However, a real deadlock is
**impossible** because the two subclass `1` locks belong to completely different
inodes (an existing parent directory vs. a newly created, unlinked EA inode).

Since lockdep is a debugging tool that is disabled in production kernel builds,
this WARNING will not occur in production environments. Furthermore, because a
real deadlock cannot happen, there is no risk of a system hang or crash.

**Conclusion:**
The bug has **no security impact**. It cannot be exploited for memory corruption
or privilege escalation, and it does not cause a Denial of Service in production
builds. It can be triggered by an unprivileged user on a standard ext4
filesystem simply by setting large xattrs (to create EA inodes), deleting them,
and then creating/unlinking normal files to manipulate the slab cache. Exploitable:false FilesystemTrigger:true NetworkTrigger:false PeripheralTrigger:false RemoteTrigger:false Unprivileged:true UserNamespace:false VMGuestTrigger:false VMHostTrigger:false]

map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE 

#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <setjmp.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>

#include <linux/loop.h>

#ifndef __NR_memfd_create
#define __NR_memfd_create 319
#endif

static unsigned long long procid;

//% This code is derived from puff.{c,h}, found in the zlib development. The
//% original files come with the following copyright notice:

//% Copyright (C) 2002-2013 Mark Adler, all rights reserved
//% version 2.3, 21 Jan 2013
//% This software is provided 'as-is', without any express or implied
//% warranty.  In no event will the author be held liable for any damages
//% arising from the use of this software.
//% Permission is granted to anyone to use this software for any purpose,
//% including commercial applications, and to alter it and redistribute it
//% freely, subject to the following restrictions:
//% 1. The origin of this software must not be misrepresented; you must not
//%    claim that you wrote the original software. If you use this software
//%    in a product, an acknowledgment in the product documentation would be
//%    appreciated but is not required.
//% 2. Altered source versions must be plainly marked as such, and must not be
//%    misrepresented as being the original software.
//% 3. This notice may not be removed or altered from any source distribution.
//% Mark Adler    madler@alumni.caltech.edu

//% BEGIN CODE DERIVED FROM puff.{c,h}

#define MAXBITS 15
#define MAXLCODES 286
#define MAXDCODES 30
#define MAXCODES (MAXLCODES + MAXDCODES)
#define FIXLCODES 288

struct puff_state {
	unsigned char* out;
	unsigned long outlen;
	unsigned long outcnt;
	const unsigned char* in;
	unsigned long inlen;
	unsigned long incnt;
	int bitbuf;
	int bitcnt;
	jmp_buf env;
};
static int puff_bits(struct puff_state* s, int need)
{
	long val = s->bitbuf;
	while (s->bitcnt < need) {
		if (s->incnt == s->inlen)
			longjmp(s->env, 1);
		val |= (long)(s->in[s->incnt++]) << s->bitcnt;
		s->bitcnt += 8;
	}
	s->bitbuf = (int)(val >> need);
	s->bitcnt -= need;
	return (int)(val & ((1L << need) - 1));
}
static int puff_stored(struct puff_state* s)
{
	s->bitbuf = 0;
	s->bitcnt = 0;
	if (s->incnt + 4 > s->inlen)
		return 2;
	unsigned len = s->in[s->incnt++];
	len |= s->in[s->incnt++] << 8;
	if (s->in[s->incnt++] != (~len & 0xff) ||
	    s->in[s->incnt++] != ((~len >> 8) & 0xff))
		return -2;
	if (s->incnt + len > s->inlen)
		return 2;
	if (s->outcnt + len > s->outlen)
		return 1;
	for (; len--; s->outcnt++, s->incnt++) {
		if (s->in[s->incnt])
			s->out[s->outcnt] = s->in[s->incnt];
	}
	return 0;
}
struct puff_huffman {
	short* count;
	short* symbol;
};
static int puff_decode(struct puff_state* s, const struct puff_huffman* h)
{
	int first = 0;
	int index = 0;
	int bitbuf = s->bitbuf;
	int left = s->bitcnt;
	int code = first = index = 0;
	int len = 1;
	short* next = h->count + 1;
	while (1) {
		while (left--) {
			code |= bitbuf & 1;
			bitbuf >>= 1;
			int count = *next++;
			if (code - count < first) {
				s->bitbuf = bitbuf;
				s->bitcnt = (s->bitcnt - len) & 7;
				return h->symbol[index + (code - first)];
			}
			index += count;
			first += count;
			first <<= 1;
			code <<= 1;
			len++;
		}
		left = (MAXBITS + 1) - len;
		if (left == 0)
			break;
		if (s->incnt == s->inlen)
			longjmp(s->env, 1);
		bitbuf = s->in[s->incnt++];
		if (left > 8)
			left = 8;
	}
	return -10;
}
static int puff_construct(struct puff_huffman* h, const short* length, int n)
{
	int len;
	for (len = 0; len <= MAXBITS; len++)
		h->count[len] = 0;
	int symbol;
	for (symbol = 0; symbol < n; symbol++)
		(h->count[length[symbol]])++;
	if (h->count[0] == n)
		return 0;
	int left = 1;
	for (len = 1; len <= MAXBITS; len++) {
		left <<= 1;
		left -= h->count[len];
		if (left < 0)
			return left;
	}
	short offs[MAXBITS + 1];
	offs[1] = 0;
	for (len = 1; len < MAXBITS; len++)
		offs[len + 1] = offs[len] + h->count[len];
	for (symbol = 0; symbol < n; symbol++)
		if (length[symbol] != 0)
			h->symbol[offs[length[symbol]]++] = symbol;
	return left;
}
static int puff_codes(struct puff_state* s,
		      const struct puff_huffman* lencode,
		      const struct puff_huffman* distcode)
{
	static const short lens[29] = {
				       3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 15, 17, 19, 23, 27, 31,
				       35, 43, 51, 59, 67, 83, 99, 115, 131, 163, 195, 227, 258};
	static const short lext[29] = {
				       0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2,
				       3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0};
	static const short dists[30] = {
					1, 2, 3, 4, 5, 7, 9, 13, 17, 25, 33, 49, 65, 97, 129, 193,
					257, 385, 513, 769, 1025, 1537, 2049, 3073, 4097, 6145,
					8193, 12289, 16385, 24577};
	static const short dext[30] = {
				       0, 0, 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6,
				       7, 7, 8, 8, 9, 9, 10, 10, 11, 11,
				       12, 12, 13, 13};
	int symbol;
	do {
		symbol = puff_decode(s, lencode);
		if (symbol < 0)
			return symbol;
		if (symbol < 256) {
			if (s->outcnt == s->outlen)
				return 1;
			if (symbol)
				s->out[s->outcnt] = symbol;
			s->outcnt++;
		} else if (symbol > 256) {
			symbol -= 257;
			if (symbol >= 29)
				return -10;
			int len = lens[symbol] + puff_bits(s, lext[symbol]);
			symbol = puff_decode(s, distcode);
			if (symbol < 0)
				return symbol;
			unsigned dist = dists[symbol] + puff_bits(s, dext[symbol]);
			if (dist > s->outcnt)
				return -11;
			if (s->outcnt + len > s->outlen)
				return 1;
			while (len--) {
				if (dist <= s->outcnt && s->out[s->outcnt - dist])
					s->out[s->outcnt] = s->out[s->outcnt - dist];
				s->outcnt++;
			}
		}
	} while (symbol != 256);
	return 0;
}
static int puff_fixed(struct puff_state* s)
{
	static int virgin = 1;
	static short lencnt[MAXBITS + 1], lensym[FIXLCODES];
	static short distcnt[MAXBITS + 1], distsym[MAXDCODES];
	static struct puff_huffman lencode, distcode;
	if (virgin) {
		lencode.count = lencnt;
		lencode.symbol = lensym;
		distcode.count = distcnt;
		distcode.symbol = distsym;
		short lengths[FIXLCODES];
		int symbol;
		for (symbol = 0; symbol < 144; symbol++)
			lengths[symbol] = 8;
		for (; symbol < 256; symbol++)
			lengths[symbol] = 9;
		for (; symbol < 280; symbol++)
			lengths[symbol] = 7;
		for (; symbol < FIXLCODES; symbol++)
			lengths[symbol] = 8;
		puff_construct(&lencode, lengths, FIXLCODES);
		for (symbol = 0; symbol < MAXDCODES; symbol++)
			lengths[symbol] = 5;
		puff_construct(&distcode, lengths, MAXDCODES);
		virgin = 0;
	}
	return puff_codes(s, &lencode, &distcode);
}
static int puff_dynamic(struct puff_state* s)
{
	static const short order[19] =
	    {16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15};
	int nlen = puff_bits(s, 5) + 257;
	int ndist = puff_bits(s, 5) + 1;
	int ncode = puff_bits(s, 4) + 4;
	if (nlen > MAXLCODES || ndist > MAXDCODES)
		return -3;
	short lengths[MAXCODES];
	int index;
	for (index = 0; index < ncode; index++)
		lengths[order[index]] = puff_bits(s, 3);
	for (; index < 19; index++)
		lengths[order[index]] = 0;
	short lencnt[MAXBITS + 1], lensym[MAXLCODES];
	struct puff_huffman lencode = {lencnt, lensym};
	int err = puff_construct(&lencode, lengths, 19);
	if (err != 0)
		return -4;
	index = 0;
	while (index < nlen + ndist) {
		int symbol;
		int len;
		symbol = puff_decode(s, &lencode);
		if (symbol < 0)
			return symbol;
		if (symbol < 16)
			lengths[index++] = symbol;
		else {
			len = 0;
			if (symbol == 16) {
				if (index == 0)
					return -5;
				len = lengths[index - 1];
				symbol = 3 + puff_bits(s, 2);
			} else if (symbol == 17)
				symbol = 3 + puff_bits(s, 3);
			else
				symbol = 11 + puff_bits(s, 7);
			if (index + symbol > nlen + ndist)
				return -6;
			while (symbol--)
				lengths[index++] = len;
		}
	}
	if (lengths[256] == 0)
		return -9;
	err = puff_construct(&lencode, lengths, nlen);
	if (err && (err < 0 || nlen != lencode.count[0] + lencode.count[1]))
		return -7;
	short distcnt[MAXBITS + 1], distsym[MAXDCODES];
	struct puff_huffman distcode = {distcnt, distsym};
	err = puff_construct(&distcode, lengths + nlen, ndist);
	if (err && (err < 0 || ndist != distcode.count[0] + distcode.count[1]))
		return -8;
	return puff_codes(s, &lencode, &distcode);
}
static int puff(
    unsigned char* dest,
    unsigned long* destlen,
    const unsigned char* source,
    unsigned long sourcelen)
{
	struct puff_state s = {
	    .out = dest,
	    .outlen = *destlen,
	    .outcnt = 0,
	    .in = source,
	    .inlen = sourcelen,
	    .incnt = 0,
	    .bitbuf = 0,
	    .bitcnt = 0,
	};
	int err;
	if (setjmp(s.env) != 0)
		err = 2;
	else {
		int last;
		do {
			last = puff_bits(&s, 1);
			int type = puff_bits(&s, 2);
			err = type == 0 ? puff_stored(&s) : (type == 1 ? puff_fixed(&s) : (type == 2 ? puff_dynamic(&s) : -1));
			if (err != 0)
				break;
		} while (!last);
	}
	*destlen = s.outcnt;
	return err;
}

//% END CODE DERIVED FROM puff.{c,h}

#define ZLIB_HEADER_WIDTH 2

static int puff_zlib_to_file(const unsigned char* source, unsigned long sourcelen, int dest_fd)
{
	if (sourcelen < ZLIB_HEADER_WIDTH)
		return 0;
	source += ZLIB_HEADER_WIDTH;
	sourcelen -= ZLIB_HEADER_WIDTH;
	const unsigned long max_destlen = 132 << 20;
	void* ret = mmap(0, max_destlen, PROT_WRITE | PROT_READ, MAP_PRIVATE | MAP_ANON, -1, 0);
	if (ret == MAP_FAILED)
		return -1;
	unsigned char* dest = (unsigned char*)ret;
	unsigned long destlen = max_destlen;
	int err = puff(dest, &destlen, source, sourcelen);
	if (err) {
		munmap(dest, max_destlen);
		errno = -err;
		return -1;
	}
	if (write(dest_fd, dest, destlen) != (ssize_t)destlen) {
		munmap(dest, max_destlen);
		return -1;
	}
	return munmap(dest, max_destlen);
}

static int setup_loop_device(unsigned char* data, unsigned long size, const char* loopname, int* loopfd_p)
{
	int err = 0, loopfd = -1;
	int memfd = syscall(__NR_memfd_create, "syzkaller", 0);
	if (memfd == -1) {
		err = errno;
		goto error;
	}
	if (puff_zlib_to_file(data, size, memfd)) {
		err = errno;
		goto error_close_memfd;
	}
	loopfd = open(loopname, O_RDWR);
	if (loopfd == -1) {
		err = errno;
		goto error_close_memfd;
	}
	if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
		if (errno != EBUSY) {
			err = errno;
			goto error_close_loop;
		}
		ioctl(loopfd, LOOP_CLR_FD, 0);
		usleep(1000);
		if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
			err = errno;
			goto error_close_loop;
		}
	}
	close(memfd);
	*loopfd_p = loopfd;
	return 0;

error_close_loop:
	close(loopfd);
error_close_memfd:
	close(memfd);
error:
	errno = err;
	return -1;
}

static void reset_loop_device(const char* loopname)
{
	int loopfd = open(loopname, O_RDWR);
	if (loopfd == -1) {
		return;
	}
	if (ioctl(loopfd, LOOP_CLR_FD, 0)) {
	}
	close(loopfd);
}

static long syz_mount_image(
    volatile long fsarg,
    volatile long dir,
    volatile long flags,
    volatile long optsarg,
    volatile long change_dir,
    volatile unsigned long size,
    volatile long image)
{
	unsigned char* data = (unsigned char*)image;
	int res = -1, err = 0, need_loop_device = !!size;
	char* mount_opts = (char*)optsarg;
	char* target = (char*)dir;
	char* fs = (char*)fsarg;
	char* source = NULL;
	char loopname[64];
	if (need_loop_device) {
		int loopfd;
		memset(loopname, 0, sizeof(loopname));
		snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid);
		if (setup_loop_device(data, size, loopname, &loopfd) == -1)
			return -1;
		close(loopfd);
		source = loopname;
	}
	mkdir(target, 0777);
	char opts[256];
	memset(opts, 0, sizeof(opts));
	if (strlen(mount_opts) > (sizeof(opts) - 32)) {
	}
	strncpy(opts, mount_opts, sizeof(opts) - 32);
	if (strcmp(fs, "iso9660") == 0) {
		flags |= MS_RDONLY;
	} else if (strncmp(fs, "ext", 3) == 0) {
		bool has_remount_ro = false;
		char* remount_ro_start = strstr(opts, "errors=remount-ro");
		if (remount_ro_start != NULL) {
			char after = *(remount_ro_start + strlen("errors=remount-ro"));
			char before = remount_ro_start == opts ? '\0' : *(remount_ro_start - 1);
			has_remount_ro = ((before == '\0' || before == ',') && (after == '\0' || after == ','));
		}
		if (strstr(opts, "errors=panic") || !has_remount_ro)
			strcat(opts, ",errors=continue");
	} else if (strcmp(fs, "xfs") == 0) {
		strcat(opts, ",nouuid");
	} else if (strncmp(fs, "gfs2", 4) == 0 && (strstr(opts, "errors=panic") || strstr(opts, "debug"))) {
		strcat(opts, ",errors=withdraw");
	}
	res = mount(source, target, fs, flags, opts);
	if (res == -1) {
		err = errno;
		goto error_clear_loop;
	}
	res = open(target, O_RDONLY | O_DIRECTORY);
	if (res == -1) {
		err = errno;
		goto error_clear_loop;
	}
	if (change_dir) {
		res = chdir(target);
		if (res == -1) {
			err = errno;
		}
	}

error_clear_loop:
	if (need_loop_device)
		reset_loop_device(loopname);
	errno = err;
	return res;
}

uint64_t r[1] = {0xffffffffffffffff};

int main(void)
{
		syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
	syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
	syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
	const char* reason;
	(void)reason;
				intptr_t res = 0;
	if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
//  syz_mount_image$ext4 arguments: [
//    fs: ptr[in, buffer] {
//      buffer: {65 78 74 34 00} (length 0x5)
//    }
//    dir: ptr[in, buffer] {
//      buffer: {2e 2f 66 69 6c 65 31 00} (length 0x8)
//    }
//    flags: mount_flags = 0x200000 (8 bytes)
//    opts: ptr[in, fs_options[ext4_options]] {
//      fs_options[ext4_options] {
//        elems: array[fs_opt_elem[ext4_options]] {
//          fs_opt_elem[ext4_options] {
//            elem: union ext4_options {
//              grpquota: buffer: {67 72 70 71 75 6f 74 61} (length 0x8)
//            }
//            comma: const = 0x2c (1 bytes)
//          }
//          fs_opt_elem[ext4_options] {
//            elem: union ext4_options {
//              bsddf: buffer: {62 73 64 64 66} (length 0x5)
//            }
//            comma: const = 0x2c (1 bytes)
//          }
//          fs_opt_elem[ext4_options] {
//            elem: union ext4_options {
//              nombcache: buffer: {6e 6f 6d 62 63 61 63 68 65} (length 0x9)
//            }
//            comma: const = 0x2c (1 bytes)
//          }
//          fs_opt_elem[ext4_options] {
//            elem: union ext4_options {
//              norecovery: buffer: {6e 6f 72 65 63 6f 76 65 72 79} (length 0xa)
//            }
//            comma: const = 0x2c (1 bytes)
//          }
//          fs_opt_elem[ext4_options] {
//            elem: union ext4_options {
//              debug_want_extra_isize: fs_opt["debug_want_extra_isize", fmt[hex, int32]] {
//                name: buffer: {64 65 62 75 67 5f 77 61 6e 74 5f 65 78 74 72 61 5f 69 73 69 7a 65} (length 0x16)
//                eq: const = 0x3d (1 bytes)
//                val: int32 = 0x80 (18 bytes)
//              }
//            }
//            comma: const = 0x2c (1 bytes)
//          }
//          fs_opt_elem[ext4_options] {
//            elem: union ext4_options {
//              lazytime: buffer: {6c 61 7a 79 74 69 6d 65} (length 0x8)
//            }
//            comma: const = 0x2c (1 bytes)
//          }
//          fs_opt_elem[ext4_options] {
//            elem: union ext4_options {
//              nodelalloc: buffer: {6e 6f 64 65 6c 61 6c 6c 6f 63} (length 0xa)
//            }
//            comma: const = 0x2c (1 bytes)
//          }
//          fs_opt_elem[ext4_options] {
//            elem: union ext4_options {
//              noblock_validity: buffer: {6e 6f 62 6c 6f 63 6b 5f 76 61 6c 69 64 69 74 79} (length 0x10)
//            }
//            comma: const = 0x2c (1 bytes)
//          }
//          fs_opt_elem[ext4_options] {
//            elem: union ext4_options {
//              noauto_da_alloc: buffer: {6e 6f 61 75 74 6f 5f 64 61 5f 61 6c 6c 6f 63} (length 0xf)
//            }
//            comma: const = 0x2c (1 bytes)
//          }
//        }
//        common: array[fs_opt_elem[fs_options_common]] {
//        }
//        null: const = 0x0 (1 bytes)
//      }
//    }
//    chdir: int8 = 0xfe (1 bytes)
//    size: len = 0x54c (8 bytes)
//    img: ptr[in, buffer] {
//      buffer: (compressed buffer with length 0x54c)
//    }
//  ]
//  returns fd_dir
memcpy((void*)0x200000000040, "ext4\000", 5);
memcpy((void*)0x200000000200, "./file1\000", 8);
memcpy((void*)0x200000000f80, "grpquota", 8);
*(uint8_t*)0x200000000f88 = 0x2c;
memcpy((void*)0x200000000f89, "bsddf", 5);
*(uint8_t*)0x200000000f8e = 0x2c;
memcpy((void*)0x200000000f8f, "nombcache", 9);
*(uint8_t*)0x200000000f98 = 0x2c;
memcpy((void*)0x200000000f99, "norecovery", 10);
*(uint8_t*)0x200000000fa3 = 0x2c;
memcpy((void*)0x200000000fa4, "debug_want_extra_isize", 22);
*(uint8_t*)0x200000000fba = 0x3d;
sprintf((char*)0x200000000fbb, "0x%016llx", (long long)0x80);
*(uint8_t*)0x200000000fcd = 0x2c;
memcpy((void*)0x200000000fce, "lazytime", 8);
*(uint8_t*)0x200000000fd6 = 0x2c;
memcpy((void*)0x200000000fd7, "nodelalloc", 10);
*(uint8_t*)0x200000000fe1 = 0x2c;
memcpy((void*)0x200000000fe2, "noblock_validity", 16);
*(uint8_t*)0x200000000ff2 = 0x2c;
memcpy((void*)0x200000000ff3, "noauto_da_alloc", 15);
*(uint8_t*)0x200000001002 = 0x2c;
*(uint8_t*)0x200000001003 = 0;
memcpy((void*)0x200000000400, "... [truncated large byte array] ...", 1356);
syz_mount_image(/*fs=*/0x200000000040, /*dir=*/0x200000000200, /*flags=MS_RELATIME*/0x200000, /*opts=*/0x200000000f80, /*chdir=*/0xfe, /*size=*/0x54c, /*img=*/0x200000000400);
//  setxattr$incfs_id arguments: [
//    path: ptr[in, buffer] {
//      buffer: {2e 2f 66 69 6c 65 30 2f 66 69 6c 65 30 00} (length 0xe)
//    }
//    name: ptr[in, buffer] {
//      buffer: {75 73 65 72 2e 69 6e 63 66 73 2e 69 64 00} (length 0xe)
//    }
//    val: ptr[in, incfs_uuid_str] {
//      incfs_uuid_str {
//        zeros: buffer: {30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30} (length 0x1f)
//        id: int8 = 0x0 (1 bytes)
//      }
//    }
//    size: bytesize = 0xff57 (8 bytes)
//    flags: setxattr_flags = 0x0 (8 bytes)
//  ]
memcpy((void*)0x200000000140, "./file0/file0\000", 14);
memcpy((void*)0x2000000001c0, "user.incfs.id\000", 14);
memset((void*)0x200000000540, 48, 31);
*(uint8_t*)0x20000000055f = 0;
	syscall(__NR_setxattr, /*path=*/0x200000000140ul, /*name=*/0x2000000001c0ul, /*val=*/0x200000000540ul, /*size=*/0xff57ul, /*flags=*/0ul);
//  open arguments: [
//    file: ptr[in, buffer] {
//      buffer: {2e 2f 66 69 6c 65 31 00} (length 0x8)
//    }
//    flags: open_flags = 0x4827e (8 bytes)
//    mode: open_mode = 0xdc (8 bytes)
//  ]
//  returns fd
memcpy((void*)0x200000000200, "./file1\000", 8);
	res = syscall(__NR_open, /*file=*/0x200000000200ul, /*flags=O_TRUNC|O_NOATIME|O_LARGEFILE|O_CREAT|O_RDWR|0x3c*/0x4827eul, /*mode=S_IROTH|S_IXGRP|S_IWGRP|S_IXUSR|S_IWUSR*/0xdcul);
	if (res != -1)
		r[0] = res;
//  fallocate arguments: [
//    fd: fd (resource)
//    mode: fallocate_mode = 0x0 (8 bytes)
//    off: intptr = 0x0 (8 bytes)
//    len: intptr = 0x8800000 (8 bytes)
//  ]
	syscall(__NR_fallocate, /*fd=*/r[0], /*mode=*/0ul, /*off=*/0ul, /*len=*/0x8800000ul);
//  unlink arguments: [
//    path: ptr[in, buffer] {
//      buffer: {2e 2f 66 69 6c 65 30 2f 66 69 6c 65 30 00} (length 0xe)
//    }
//  ]
memcpy((void*)0x200000000080, "./file0/file0\000", 14);
	syscall(__NR_unlink, /*path=*/0x200000000080ul);
	return 0;
}
]

map[KernelSrc:/app/workdir/cache/src/4835de48acf3818d0e01a202bfd1c3d807937b48]

map[KernelObj:/app/workdir/cache/build/7b535ecbf2f278915a56837ce59aa82eae38a1db]

map[Index:codesearch-index]

gemini-3.1-pro-preview

map[DenialOfService:false Exploitable:false FilesystemTrigger:true NetworkTrigger:false PeripheralTrigger:false RemoteTrigger:false Unprivileged:true UserNamespace:false VMGuestTrigger:false VMHostTrigger:false]

You are an experienced Linux kernel security engineer. Your task is to analyze given kernel bug report
and determine its security impact based on the following dimensions.

Use the provided tools to examine the source code, check for capability checks (e.g., capable(), ns_capable()),
and understand the nature of the bug. Analyze the given kernel build and configuration.
You can check the kernel config by grepping ".config" file; you can check kernel cmdline by greeping
".config" file for "CONFIG_CMDLINE=". Assume sysctl parameters have default values.
But analyze for the corresponding production build w/o debugging tools enabled (like KASAN, KMSAN, UBSAN).

Try different strategies when analyzing the bug:
 - think of ways in which the vulnerable code is unreachable
 - or the other way around: try to come up with different ideas of how an unprivileged user can reach the bug
If still unsure err on the side of the bug being non-exploitable/not-accessible.
In the final reply, provide a reasoning for your assessment.

Analysis dimensions:

* Exploitable:
Determine if the bug can result in memory corruption or elevated privileges.
Memory safety issues are almost always exploitable (KASAN or UBSAN reports for use-after-free, out-of-bounds;
refcounting issues, corrupted lists, etc). When kernel is crashing on a completly wild pointer access
(e.g. user-space address, or non-canonical address, but not on NULL or address corresponding to KASAN shadow
for NULL address), including both data accesses and control tranfers, that's also usually implies possibility
of exploitation. Such reports usually say "unable to handle kernel paging request".
Uses of uninitialized values detected by KMSAN may be exploitable b/c attacker frequently can affect uninit
values with spraying techniques. However, for these exploitabability depends on how exactly the uninit value
is used in the code, and what it affects.

Think of what happens after the bug is triggered. Some bugs cause kernel panic and halt execution,
they are harder to exploit. For example, BUG reports halts the kernel. However, WARNING reports don't halt
execution in production builds. Debug bug detection tools (like KASAN, KMSAN, KCSAN, UBSAN) are also not enabled
in production builds, so attacker can freely exploit these bugs w/o being detected by these tools.
If you see an integer overflow, think how the overflowed value used later (if it's used as allocation size,
or an array index). If you see an out-of-bounds read, think if it's followed by an out-of-bounds write as well.
Some KCSAN data-races may be exploitable by skilled attackers as well. Think what data structures got corrupted
as the result of data races and how. However, note that kernel has lots of "benign" data races that don't lead
to any runtime misbehavior at all.

* Denial Of Service:
Determine if the bug can result in denial-of-service. Most bugs can, since they cause system crash,
hangs, deadlocks, or resource leaks. This is mostly applicable to WARNING bugs that won't cause system crash
in production. For these think what will be consequences of the violation of the kernel assumptions flagged
by the WARNING. In some cases the unexpected condition is also properly handled by the normal control flow
(e.g. with "if (WARN_ON(...))"), these won't cause denial-of-service. If the condition is not handled,
then it may or may not cause denial-of-service.

* Accessible From Unprivileged Processes:
Determine if the bug can be reached from a typical (non-root) user process that does NOT have any special capabilities
(like CAP_SYS_ADMIN, CAP_NET_ADMIN, CAP_NET_RAW, CAP_PERFMON) or access to device nodes restricted to root.
Assume that unprivileged_bpf_disabled=1, that is eBPF loading is not accessible. However, cBPF (classical BPF)
is still accessible to non-root processes.
Assume that user namespaces are not accessible, that is, the process cannot get the mentioned capabilities even
within a new user namespace (checked by ns_capable() function in the kernel sources).

* Accessible From User Namespaces:
Determine if the bug can be reached within a user-namespace where the process has all capabilities
(including CAP_SYS_ADMIN, CAP_NET_ADMIN, CAP_NET_RAW, CAP_PERFMON). Such capabilities are checked with ns_capable()
function in the kernel sources.

* VM Guest Trigger:
Determine if the bug can be triggered from the context of a typical KVM guest (e.g., set up by a QEMU VMM).
Consider accesses to standard Linux host paravirtualized features (virtio-blk, virtio-net, etc.),
and handling of VM exits in the KVM code.

* VM Host Trigger in The Confidetial Computing Context:
Determine if the bug can be triggered in a confidential computing guest kernel from the context of a KVM host.
Consider access to standard Linux guest paravirtualized features (virtio-blk, virtio-net, etc.).

* Ethernet Network Trigger:
Determine if the bug can be triggered by processing ingress network Ethernet traffic, either directly (network stack)
or via drivers exposed to network data.

* Other Remote Trigger:
Determine if the bug can be triggered by processing remote traffic other than Ethernet (Wifi, Bluetooth, NFC, etc).

* Peripheral Trigger:
Determine if the bug can be triggered via an untrusted peripheral device that can be physically plugged
into a system, such as a USB device or a niche hardware driver handling external hardware inputs.
This is particularly important for mobile and desktop environments where users can plug in unknown devices.

* Malicious Filesystem Trigger:
Determine if the bug can be triggered by the kernel mounting and parsing a malicious filesystem image.
This is highly critical for Desktop and Mobile environments where external media or downloaded images
might be auto-mounted.

Don't make assumptions about the kernel source code (it may be different from what you assume it is).
Extensively use the provided code access tools (codesearch-*, git-*, grepper, etc)
to examine the actual source code, and confirm any assumptions.

Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

The kernel bug report is:

loop0: detected capacity change from 0 to 1024
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.0.57/6273 is trying to acquire lock:
ffff8880588cd060 (&sb->s_type->i_mutex_key#9/1){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:869 [inline]
ffff8880588cd060 (&sb->s_type->i_mutex_key#9/1){+.+.}-{4:4}, at: ext4_xattr_inode_create fs/ext4/xattr.c:1506 [inline]
ffff8880588cd060 (&sb->s_type->i_mutex_key#9/1){+.+.}-{4:4}, at: ext4_xattr_inode_lookup_create+0x17d4/0x1c20 fs/ext4/xattr.c:1588

but task is already holding lock:
ffff888058921590 (&ei->i_data_sem/3){++++}-{4:4}, at: ext4_truncate+0x93f/0x1100 fs/ext4/inode.c:4639

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (&ei->i_data_sem/3){++++}-{4:4}:
       lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868
       down_write+0x96/0x1f0 kernel/locking/rwsem.c:1590
       ext4_update_i_disksize fs/ext4/ext4.h:3431 [inline]
       ext4_xattr_inode_write fs/ext4/xattr.c:1444 [inline]
       ext4_xattr_inode_lookup_create+0x14d1/0x1c20 fs/ext4/xattr.c:1594
       ext4_xattr_ibody_set+0x202/0x6a0 fs/ext4/xattr.c:2258
       ext4_xattr_set_handle+0xc9a/0x1590 fs/ext4/xattr.c:2435
       ext4_xattr_set+0x230/0x320 fs/ext4/xattr.c:2549
       __vfs_setxattr+0x43c/0x480 fs/xattr.c:200
       __vfs_setxattr_noperm+0x12d/0x660 fs/xattr.c:234
       vfs_setxattr+0x16b/0x2f0 fs/xattr.c:321
       do_setxattr fs/xattr.c:636 [inline]
       filename_setxattr+0x274/0x600 fs/xattr.c:665
       path_setxattrat+0x364/0x3a0 fs/xattr.c:713
       __do_sys_setxattr fs/xattr.c:747 [inline]
       __se_sys_setxattr fs/xattr.c:743 [inline]
       __x64_sys_setxattr+0xbc/0xe0 fs/xattr.c:743
       do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
       do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #0 (&sb->s_type->i_mutex_key#9/1){+.+.}-{4:4}:
       check_prev_add kernel/locking/lockdep.c:3165 [inline]
       check_prevs_add kernel/locking/lockdep.c:3284 [inline]
       validate_chain+0xb9b/0x2140 kernel/locking/lockdep.c:3908
       __lock_acquire+0xab9/0xd20 kernel/locking/lockdep.c:5237
       lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868
       down_write+0x96/0x1f0 kernel/locking/rwsem.c:1590
       inode_lock include/linux/fs.h:869 [inline]
       ext4_xattr_inode_create fs/ext4/xattr.c:1506 [inline]
       ext4_xattr_inode_lookup_create+0x17d4/0x1c20 fs/ext4/xattr.c:1588
       ext4_xattr_block_set+0x223/0x2ac0 fs/ext4/xattr.c:1908
       ext4_xattr_move_to_block fs/ext4/xattr.c:2659 [inline]
       ext4_xattr_make_inode_space fs/ext4/xattr.c:2734 [inline]
       ext4_expand_extra_isize_ea+0x12d5/0x1ea0 fs/ext4/xattr.c:2822
       __ext4_expand_extra_isize+0x30d/0x400 fs/ext4/inode.c:6385
       ext4_try_to_expand_extra_isize fs/ext4/inode.c:6428 [inline]
       __ext4_mark_inode_dirty+0x46c/0x700 fs/ext4/inode.c:6506
       ext4_ext_truncate+0xac/0x300 fs/ext4/extents.c:4475
       ext4_truncate+0x9c0/0x1100 fs/ext4/inode.c:4643
       ext4_evict_inode+0x8cf/0xee0 fs/ext4/inode.c:261
       evict+0x504/0x9c0 fs/inode.c:810
       do_unlinkat+0x39f/0x560 fs/namei.c:4657
       __do_sys_unlink fs/namei.c:4696 [inline]
       __se_sys_unlink fs/namei.c:4694 [inline]
       __x64_sys_unlink+0x47/0x50 fs/namei.c:4694
       do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
       do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&ei->i_data_sem/3);
                               lock(&sb->s_type->i_mutex_key#9/1);
                               lock(&ei->i_data_sem/3);
  lock(&sb->s_type->i_mutex_key#9/1);

 *** DEADLOCK ***

4 locks held by syz.0.57/6273:
 #0: ffff88807d068428 (sb_writers#4){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:557
 #1: ffff88807d068618 (sb_internal){.+.+}-{0:0}, at: percpu_down_read_freezable include/linux/percpu-rwsem.h:83 [inline]
 #1: ffff88807d068618 (sb_internal){.+.+}-{0:0}, at: __sb_start_write include/linux/fs.h:1798 [inline]
 #1: ffff88807d068618 (sb_internal){.+.+}-{0:0}, at: sb_start_intwrite include/linux/fs.h:1981 [inline]
 #1: ffff88807d068618 (sb_internal){.+.+}-{0:0}, at: ext4_evict_inode+0x2d6/0xee0 fs/ext4/inode.c:215
 #2: ffff888058921590 (&ei->i_data_sem/3){++++}-{4:4}, at: ext4_truncate+0x93f/0x1100 fs/ext4/inode.c:4639
 #3: ffff8880589213e8 (&ei->xattr_sem){++++}-{4:4}, at: ext4_write_trylock_xattr fs/ext4/xattr.h:164 [inline]
 #3: ffff8880589213e8 (&ei->xattr_sem){++++}-{4:4}, at: ext4_try_to_expand_extra_isize fs/ext4/inode.c:6425 [inline]
 #3: ffff8880589213e8 (&ei->xattr_sem){++++}-{4:4}, at: __ext4_mark_inode_dirty+0x3eb/0x700 fs/ext4/inode.c:6506

stack backtrace:
CPU: 0 UID: 0 PID: 6273 Comm: syz.0.57 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 print_circular_bug+0x2ee/0x310 kernel/locking/lockdep.c:2043
 check_noncircular+0x134/0x160 kernel/locking/lockdep.c:2175
 check_prev_add kernel/locking/lockdep.c:3165 [inline]
 check_prevs_add kernel/locking/lockdep.c:3284 [inline]
 validate_chain+0xb9b/0x2140 kernel/locking/lockdep.c:3908
 __lock_acquire+0xab9/0xd20 kernel/locking/lockdep.c:5237
 lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868
 down_write+0x96/0x1f0 kernel/locking/rwsem.c:1590
 inode_lock include/linux/fs.h:869 [inline]
 ext4_xattr_inode_create fs/ext4/xattr.c:1506 [inline]
 ext4_xattr_inode_lookup_create+0x17d4/0x1c20 fs/ext4/xattr.c:1588
 ext4_xattr_block_set+0x223/0x2ac0 fs/ext4/xattr.c:1908
 ext4_xattr_move_to_block fs/ext4/xattr.c:2659 [inline]
 ext4_xattr_make_inode_space fs/ext4/xattr.c:2734 [inline]
 ext4_expand_extra_isize_ea+0x12d5/0x1ea0 fs/ext4/xattr.c:2822
 __ext4_expand_extra_isize+0x30d/0x400 fs/ext4/inode.c:6385
 ext4_try_to_expand_extra_isize fs/ext4/inode.c:6428 [inline]
 __ext4_mark_inode_dirty+0x46c/0x700 fs/ext4/inode.c:6506
 ext4_ext_truncate+0xac/0x300 fs/ext4/extents.c:4475
 ext4_truncate+0x9c0/0x1100 fs/ext4/inode.c:4643
 ext4_evict_inode+0x8cf/0xee0 fs/ext4/inode.c:261
 evict+0x504/0x9c0 fs/inode.c:810
 do_unlinkat+0x39f/0x560 fs/namei.c:4657
 __do_sys_unlink fs/namei.c:4696 [inline]
 __se_sys_unlink fs/namei.c:4694 [inline]
 __x64_sys_unlink+0x47/0x50 fs/namei.c:4694
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f15e1f8ebe9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffc6559138 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 00007f15e21b5fa0 RCX: 00007f15e1f8ebe9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000080
RBP: 00007f15e2011e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f15e21b5fa0 R14: 00007f15e21b5fa0 R15: 0000000000000001
 </TASK>




It is reproducible with the followint program.
Keep in mind that it may lack the precise threading, sandboxing, and some arguments of a working reproducer.
But it should give an idea of the involved syscalls.

// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE 

#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <setjmp.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>

#include <linux/loop.h>

#ifndef __NR_memfd_create
#define __NR_memfd_create 319
#endif

static unsigned long long procid;

//% This code is derived from puff.{c,h}, found in the zlib development. The
//% original files come with the following copyright notice:

//% Copyright (C) 2002-2013 Mark Adler, all rights reserved
//% version 2.3, 21 Jan 2013
//% This software is provided 'as-is', without any express or implied
//% warranty.  In no event will the author be held liable for any damages
//% arising from the use of this software.
//% Permission is granted to anyone to use this software for any purpose,
//% including commercial applications, and to alter it and redistribute it
//% freely, subject to the following restrictions:
//% 1. The origin of this software must not be misrepresented; you must not
//%    claim that you wrote the original software. If you use this software
//%    in a product, an acknowledgment in the product documentation would be
//%    appreciated but is not required.
//% 2. Altered source versions must be plainly marked as such, and must not be
//%    misrepresented as being the original software.
//% 3. This notice may not be removed or altered from any source distribution.
//% Mark Adler    madler@alumni.caltech.edu

//% BEGIN CODE DERIVED FROM puff.{c,h}

#define MAXBITS 15
#define MAXLCODES 286
#define MAXDCODES 30
#define MAXCODES (MAXLCODES + MAXDCODES)
#define FIXLCODES 288

struct puff_state {
	unsigned char* out;
	unsigned long outlen;
	unsigned long outcnt;
	const unsigned char* in;
	unsigned long inlen;
	unsigned long incnt;
	int bitbuf;
	int bitcnt;
	jmp_buf env;
};
static int puff_bits(struct puff_state* s, int need)
{
	long val = s->bitbuf;
	while (s->bitcnt < need) {
		if (s->incnt == s->inlen)
			longjmp(s->env, 1);
		val |= (long)(s->in[s->incnt++]) << s->bitcnt;
		s->bitcnt += 8;
	}
	s->bitbuf = (int)(val >> need);
	s->bitcnt -= need;
	return (int)(val & ((1L << need) - 1));
}
static int puff_stored(struct puff_state* s)
{
	s->bitbuf = 0;
	s->bitcnt = 0;
	if (s->incnt + 4 > s->inlen)
		return 2;
	unsigned len = s->in[s->incnt++];
	len |= s->in[s->incnt++] << 8;
	if (s->in[s->incnt++] != (~len & 0xff) ||
	    s->in[s->incnt++] != ((~len >> 8) & 0xff))
		return -2;
	if (s->incnt + len > s->inlen)
		return 2;
	if (s->outcnt + len > s->outlen)
		return 1;
	for (; len--; s->outcnt++, s->incnt++) {
		if (s->in[s->incnt])
			s->out[s->outcnt] = s->in[s->incnt];
	}
	return 0;
}
struct puff_huffman {
	short* count;
	short* symbol;
};
static int puff_decode(struct puff_state* s, const struct puff_huffman* h)
{
	int first = 0;
	int index = 0;
	int bitbuf = s->bitbuf;
	int left = s->bitcnt;
	int code = first = index = 0;
	int len = 1;
	short* next = h->count + 1;
	while (1) {
		while (left--) {
			code |= bitbuf & 1;
			bitbuf >>= 1;
			int count = *next++;
			if (code - count < first) {
				s->bitbuf = bitbuf;
				s->bitcnt = (s->bitcnt - len) & 7;
				return h->symbol[index + (code - first)];
			}
			index += count;
			first += count;
			first <<= 1;
			code <<= 1;
			len++;
		}
		left = (MAXBITS + 1) - len;
		if (left == 0)
			break;
		if (s->incnt == s->inlen)
			longjmp(s->env, 1);
		bitbuf = s->in[s->incnt++];
		if (left > 8)
			left = 8;
	}
	return -10;
}
static int puff_construct(struct puff_huffman* h, const short* length, int n)
{
	int len;
	for (len = 0; len <= MAXBITS; len++)
		h->count[len] = 0;
	int symbol;
	for (symbol = 0; symbol < n; symbol++)
		(h->count[length[symbol]])++;
	if (h->count[0] == n)
		return 0;
	int left = 1;
	for (len = 1; len <= MAXBITS; len++) {
		left <<= 1;
		left -= h->count[len];
		if (left < 0)
			return left;
	}
	short offs[MAXBITS + 1];
	offs[1] = 0;
	for (len = 1; len < MAXBITS; len++)
		offs[len + 1] = offs[len] + h->count[len];
	for (symbol = 0; symbol < n; symbol++)
		if (length[symbol] != 0)
			h->symbol[offs[length[symbol]]++] = symbol;
	return left;
}
static int puff_codes(struct puff_state* s,
		      const struct puff_huffman* lencode,
		      const struct puff_huffman* distcode)
{
	static const short lens[29] = {
				       3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 15, 17, 19, 23, 27, 31,
				       35, 43, 51, 59, 67, 83, 99, 115, 131, 163, 195, 227, 258};
	static const short lext[29] = {
				       0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2,
				       3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0};
	static const short dists[30] = {
					1, 2, 3, 4, 5, 7, 9, 13, 17, 25, 33, 49, 65, 97, 129, 193,
					257, 385, 513, 769, 1025, 1537, 2049, 3073, 4097, 6145,
					8193, 12289, 16385, 24577};
	static const short dext[30] = {
				       0, 0, 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6,
				       7, 7, 8, 8, 9, 9, 10, 10, 11, 11,
				       12, 12, 13, 13};
	int symbol;
	do {
		symbol = puff_decode(s, lencode);
		if (symbol < 0)
			return symbol;
		if (symbol < 256) {
			if (s->outcnt == s->outlen)
				return 1;
			if (symbol)
				s->out[s->outcnt] = symbol;
			s->outcnt++;
		} else if (symbol > 256) {
			symbol -= 257;
			if (symbol >= 29)
				return -10;
			int len = lens[symbol] + puff_bits(s, lext[symbol]);
			symbol = puff_decode(s, distcode);
			if (symbol < 0)
				return symbol;
			unsigned dist = dists[symbol] + puff_bits(s, dext[symbol]);
			if (dist > s->outcnt)
				return -11;
			if (s->outcnt + len > s->outlen)
				return 1;
			while (len--) {
				if (dist <= s->outcnt && s->out[s->outcnt - dist])
					s->out[s->outcnt] = s->out[s->outcnt - dist];
				s->outcnt++;
			}
		}
	} while (symbol != 256);
	return 0;
}
static int puff_fixed(struct puff_state* s)
{
	static int virgin = 1;
	static short lencnt[MAXBITS + 1], lensym[FIXLCODES];
	static short distcnt[MAXBITS + 1], distsym[MAXDCODES];
	static struct puff_huffman lencode, distcode;
	if (virgin) {
		lencode.count = lencnt;
		lencode.symbol = lensym;
		distcode.count = distcnt;
		distcode.symbol = distsym;
		short lengths[FIXLCODES];
		int symbol;
		for (symbol = 0; symbol < 144; symbol++)
			lengths[symbol] = 8;
		for (; symbol < 256; symbol++)
			lengths[symbol] = 9;
		for (; symbol < 280; symbol++)
			lengths[symbol] = 7;
		for (; symbol < FIXLCODES; symbol++)
			lengths[symbol] = 8;
		puff_construct(&lencode, lengths, FIXLCODES);
		for (symbol = 0; symbol < MAXDCODES; symbol++)
			lengths[symbol] = 5;
		puff_construct(&distcode, lengths, MAXDCODES);
		virgin = 0;
	}
	return puff_codes(s, &lencode, &distcode);
}
static int puff_dynamic(struct puff_state* s)
{
	static const short order[19] =
	    {16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15};
	int nlen = puff_bits(s, 5) + 257;
	int ndist = puff_bits(s, 5) + 1;
	int ncode = puff_bits(s, 4) + 4;
	if (nlen > MAXLCODES || ndist > MAXDCODES)
		return -3;
	short lengths[MAXCODES];
	int index;
	for (index = 0; index < ncode; index++)
		lengths[order[index]] = puff_bits(s, 3);
	for (; index < 19; index++)
		lengths[order[index]] = 0;
	short lencnt[MAXBITS + 1], lensym[MAXLCODES];
	struct puff_huffman lencode = {lencnt, lensym};
	int err = puff_construct(&lencode, lengths, 19);
	if (err != 0)
		return -4;
	index = 0;
	while (index < nlen + ndist) {
		int symbol;
		int len;
		symbol = puff_decode(s, &lencode);
		if (symbol < 0)
			return symbol;
		if (symbol < 16)
			lengths[index++] = symbol;
		else {
			len = 0;
			if (symbol == 16) {
				if (index == 0)
					return -5;
				len = lengths[index - 1];
				symbol = 3 + puff_bits(s, 2);
			} else if (symbol == 17)
				symbol = 3 + puff_bits(s, 3);
			else
				symbol = 11 + puff_bits(s, 7);
			if (index + symbol > nlen + ndist)
				return -6;
			while (symbol--)
				lengths[index++] = len;
		}
	}
	if (lengths[256] == 0)
		return -9;
	err = puff_construct(&lencode, lengths, nlen);
	if (err && (err < 0 || nlen != lencode.count[0] + lencode.count[1]))
		return -7;
	short distcnt[MAXBITS + 1], distsym[MAXDCODES];
	struct puff_huffman distcode = {distcnt, distsym};
	err = puff_construct(&distcode, lengths + nlen, ndist);
	if (err && (err < 0 || ndist != distcode.count[0] + distcode.count[1]))
		return -8;
	return puff_codes(s, &lencode, &distcode);
}
static int puff(
    unsigned char* dest,
    unsigned long* destlen,
    const unsigned char* source,
    unsigned long sourcelen)
{
	struct puff_state s = {
	    .out = dest,
	    .outlen = *destlen,
	    .outcnt = 0,
	    .in = source,
	    .inlen = sourcelen,
	    .incnt = 0,
	    .bitbuf = 0,
	    .bitcnt = 0,
	};
	int err;
	if (setjmp(s.env) != 0)
		err = 2;
	else {
		int last;
		do {
			last = puff_bits(&s, 1);
			int type = puff_bits(&s, 2);
			err = type == 0 ? puff_stored(&s) : (type == 1 ? puff_fixed(&s) : (type == 2 ? puff_dynamic(&s) : -1));
			if (err != 0)
				break;
		} while (!last);
	}
	*destlen = s.outcnt;
	return err;
}

//% END CODE DERIVED FROM puff.{c,h}

#define ZLIB_HEADER_WIDTH 2

static int puff_zlib_to_file(const unsigned char* source, unsigned long sourcelen, int dest_fd)
{
	if (sourcelen < ZLIB_HEADER_WIDTH)
		return 0;
	source += ZLIB_HEADER_WIDTH;
	sourcelen -= ZLIB_HEADER_WIDTH;
	const unsigned long max_destlen = 132 << 20;
	void* ret = mmap(0, max_destlen, PROT_WRITE | PROT_READ, MAP_PRIVATE | MAP_ANON, -1, 0);
	if (ret == MAP_FAILED)
		return -1;
	unsigned char* dest = (unsigned char*)ret;
	unsigned long destlen = max_destlen;
	int err = puff(dest, &destlen, source, sourcelen);
	if (err) {
		munmap(dest, max_destlen);
		errno = -err;
		return -1;
	}
	if (write(dest_fd, dest, destlen) != (ssize_t)destlen) {
		munmap(dest, max_destlen);
		return -1;
	}
	return munmap(dest, max_destlen);
}

static int setup_loop_device(unsigned char* data, unsigned long size, const char* loopname, int* loopfd_p)
{
	int err = 0, loopfd = -1;
	int memfd = syscall(__NR_memfd_create, "syzkaller", 0);
	if (memfd == -1) {
		err = errno;
		goto error;
	}
	if (puff_zlib_to_file(data, size, memfd)) {
		err = errno;
		goto error_close_memfd;
	}
	loopfd = open(loopname, O_RDWR);
	if (loopfd == -1) {
		err = errno;
		goto error_close_memfd;
	}
	if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
		if (errno != EBUSY) {
			err = errno;
			goto error_close_loop;
		}
		ioctl(loopfd, LOOP_CLR_FD, 0);
		usleep(1000);
		if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
			err = errno;
			goto error_close_loop;
		}
	}
	close(memfd);
	*loopfd_p = loopfd;
	return 0;

error_close_loop:
	close(loopfd);
error_close_memfd:
	close(memfd);
error:
	errno = err;
	return -1;
}

static void reset_loop_device(const char* loopname)
{
	int loopfd = open(loopname, O_RDWR);
	if (loopfd == -1) {
		return;
	}
	if (ioctl(loopfd, LOOP_CLR_FD, 0)) {
	}
	close(loopfd);
}

static long syz_mount_image(
    volatile long fsarg,
    volatile long dir,
    volatile long flags,
    volatile long optsarg,
    volatile long change_dir,
    volatile unsigned long size,
    volatile long image)
{
	unsigned char* data = (unsigned char*)image;
	int res = -1, err = 0, need_loop_device = !!size;
	char* mount_opts = (char*)optsarg;
	char* target = (char*)dir;
	char* fs = (char*)fsarg;
	char* source = NULL;
	char loopname[64];
	if (need_loop_device) {
		int loopfd;
		memset(loopname, 0, sizeof(loopname));
		snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid);
		if (setup_loop_device(data, size, loopname, &loopfd) == -1)
			return -1;
		close(loopfd);
		source = loopname;
	}
	mkdir(target, 0777);
	char opts[256];
	memset(opts, 0, sizeof(opts));
	if (strlen(mount_opts) > (sizeof(opts) - 32)) {
	}
	strncpy(opts, mount_opts, sizeof(opts) - 32);
	if (strcmp(fs, "iso9660") == 0) {
		flags |= MS_RDONLY;
	} else if (strncmp(fs, "ext", 3) == 0) {
		bool has_remount_ro = false;
		char* remount_ro_start = strstr(opts, "errors=remount-ro");
		if (remount_ro_start != NULL) {
			char after = *(remount_ro_start + strlen("errors=remount-ro"));
			char before = remount_ro_start == opts ? '\0' : *(remount_ro_start - 1);
			has_remount_ro = ((before == '\0' || before == ',') && (after == '\0' || after == ','));
		}
		if (strstr(opts, "errors=panic") || !has_remount_ro)
			strcat(opts, ",errors=continue");
	} else if (strcmp(fs, "xfs") == 0) {
		strcat(opts, ",nouuid");
	} else if (strncmp(fs, "gfs2", 4) == 0 && (strstr(opts, "errors=panic") || strstr(opts, "debug"))) {
		strcat(opts, ",errors=withdraw");
	}
	res = mount(source, target, fs, flags, opts);
	if (res == -1) {
		err = errno;
		goto error_clear_loop;
	}
	res = open(target, O_RDONLY | O_DIRECTORY);
	if (res == -1) {
		err = errno;
		goto error_clear_loop;
	}
	if (change_dir) {
		res = chdir(target);
		if (res == -1) {
			err = errno;
		}
	}

error_clear_loop:
	if (need_loop_device)
		reset_loop_device(loopname);
	errno = err;
	return res;
}

uint64_t r[1] = {0xffffffffffffffff};

int main(void)
{
		syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
	syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
	syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
	const char* reason;
	(void)reason;
				intptr_t res = 0;
	if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
//  syz_mount_image$ext4 arguments: [
//    fs: ptr[in, buffer] {
//      buffer: {65 78 74 34 00} (length 0x5)
//    }
//    dir: ptr[in, buffer] {
//      buffer: {2e 2f 66 69 6c 65 31 00} (length 0x8)
//    }
//    flags: mount_flags = 0x200000 (8 bytes)
//    opts: ptr[in, fs_options[ext4_options]] {
//      fs_options[ext4_options] {
//        elems: array[fs_opt_elem[ext4_options]] {
//          fs_opt_elem[ext4_options] {
//            elem: union ext4_options {
//              grpquota: buffer: {67 72 70 71 75 6f 74 61} (length 0x8)
//            }
//            comma: const = 0x2c (1 bytes)
//          }
//          fs_opt_elem[ext4_options] {
//            elem: union ext4_options {
//              bsddf: buffer: {62 73 64 64 66} (length 0x5)
//            }
//            comma: const = 0x2c (1 bytes)
//          }
//          fs_opt_elem[ext4_options] {
//            elem: union ext4_options {
//              nombcache: buffer: {6e 6f 6d 62 63 61 63 68 65} (length 0x9)
//            }
//            comma: const = 0x2c (1 bytes)
//          }
//          fs_opt_elem[ext4_options] {
//            elem: union ext4_options {
//              norecovery: buffer: {6e 6f 72 65 63 6f 76 65 72 79} (length 0xa)
//            }
//            comma: const = 0x2c (1 bytes)
//          }
//          fs_opt_elem[ext4_options] {
//            elem: union ext4_options {
//              debug_want_extra_isize: fs_opt["debug_want_extra_isize", fmt[hex, int32]] {
//                name: buffer: {64 65 62 75 67 5f 77 61 6e 74 5f 65 78 74 72 61 5f 69 73 69 7a 65} (length 0x16)
//                eq: const = 0x3d (1 bytes)
//                val: int32 = 0x80 (18 bytes)
//              }
//            }
//            comma: const = 0x2c (1 bytes)
//          }
//          fs_opt_elem[ext4_options] {
//            elem: union ext4_options {
//              lazytime: buffer: {6c 61 7a 79 74 69 6d 65} (length 0x8)
//            }
//            comma: const = 0x2c (1 bytes)
//          }
//          fs_opt_elem[ext4_options] {
//            elem: union ext4_options {
//              nodelalloc: buffer: {6e 6f 64 65 6c 61 6c 6c 6f 63} (length 0xa)
//            }
//            comma: const = 0x2c (1 bytes)
//          }
//          fs_opt_elem[ext4_options] {
//            elem: union ext4_options {
//              noblock_validity: buffer: {6e 6f 62 6c 6f 63 6b 5f 76 61 6c 69 64 69 74 79} (length 0x10)
//            }
//            comma: const = 0x2c (1 bytes)
//          }
//          fs_opt_elem[ext4_options] {
//            elem: union ext4_options {
//              noauto_da_alloc: buffer: {6e 6f 61 75 74 6f 5f 64 61 5f 61 6c 6c 6f 63} (length 0xf)
//            }
//            comma: const = 0x2c (1 bytes)
//          }
//        }
//        common: array[fs_opt_elem[fs_options_common]] {
//        }
//        null: const = 0x0 (1 bytes)
//      }
//    }
//    chdir: int8 = 0xfe (1 bytes)
//    size: len = 0x54c (8 bytes)
//    img: ptr[in, buffer] {
//      buffer: (compressed buffer with length 0x54c)
//    }
//  ]
//  returns fd_dir
memcpy((void*)0x200000000040, "ext4\000", 5);
memcpy((void*)0x200000000200, "./file1\000", 8);
memcpy((void*)0x200000000f80, "grpquota", 8);
*(uint8_t*)0x200000000f88 = 0x2c;
memcpy((void*)0x200000000f89, "bsddf", 5);
*(uint8_t*)0x200000000f8e = 0x2c;
memcpy((void*)0x200000000f8f, "nombcache", 9);
*(uint8_t*)0x200000000f98 = 0x2c;
memcpy((void*)0x200000000f99, "norecovery", 10);
*(uint8_t*)0x200000000fa3 = 0x2c;
memcpy((void*)0x200000000fa4, "debug_want_extra_isize", 22);
*(uint8_t*)0x200000000fba = 0x3d;
sprintf((char*)0x200000000fbb, "0x%016llx", (long long)0x80);
*(uint8_t*)0x200000000fcd = 0x2c;
memcpy((void*)0x200000000fce, "lazytime", 8);
*(uint8_t*)0x200000000fd6 = 0x2c;
memcpy((void*)0x200000000fd7, "nodelalloc", 10);
*(uint8_t*)0x200000000fe1 = 0x2c;
memcpy((void*)0x200000000fe2, "noblock_validity", 16);
*(uint8_t*)0x200000000ff2 = 0x2c;
memcpy((void*)0x200000000ff3, "noauto_da_alloc", 15);
*(uint8_t*)0x200000001002 = 0x2c;
*(uint8_t*)0x200000001003 = 0;
memcpy((void*)0x200000000400, "... [truncated large byte array] ...", 1356);
syz_mount_image(/*fs=*/0x200000000040, /*dir=*/0x200000000200, /*flags=MS_RELATIME*/0x200000, /*opts=*/0x200000000f80, /*chdir=*/0xfe, /*size=*/0x54c, /*img=*/0x200000000400);
//  setxattr$incfs_id arguments: [
//    path: ptr[in, buffer] {
//      buffer: {2e 2f 66 69 6c 65 30 2f 66 69 6c 65 30 00} (length 0xe)
//    }
//    name: ptr[in, buffer] {
//      buffer: {75 73 65 72 2e 69 6e 63 66 73 2e 69 64 00} (length 0xe)
//    }
//    val: ptr[in, incfs_uuid_str] {
//      incfs_uuid_str {
//        zeros: buffer: {30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30} (length 0x1f)
//        id: int8 = 0x0 (1 bytes)
//      }
//    }
//    size: bytesize = 0xff57 (8 bytes)
//    flags: setxattr_flags = 0x0 (8 bytes)
//  ]
memcpy((void*)0x200000000140, "./file0/file0\000", 14);
memcpy((void*)0x2000000001c0, "user.incfs.id\000", 14);
memset((void*)0x200000000540, 48, 31);
*(uint8_t*)0x20000000055f = 0;
	syscall(__NR_setxattr, /*path=*/0x200000000140ul, /*name=*/0x2000000001c0ul, /*val=*/0x200000000540ul, /*size=*/0xff57ul, /*flags=*/0ul);
//  open arguments: [
//    file: ptr[in, buffer] {
//      buffer: {2e 2f 66 69 6c 65 31 00} (length 0x8)
//    }
//    flags: open_flags = 0x4827e (8 bytes)
//    mode: open_mode = 0xdc (8 bytes)
//  ]
//  returns fd
memcpy((void*)0x200000000200, "./file1\000", 8);
	res = syscall(__NR_open, /*file=*/0x200000000200ul, /*flags=O_TRUNC|O_NOATIME|O_LARGEFILE|O_CREAT|O_RDWR|0x3c*/0x4827eul, /*mode=S_IROTH|S_IXGRP|S_IWGRP|S_IXUSR|S_IWUSR*/0xdcul);
	if (res != -1)
		r[0] = res;
//  fallocate arguments: [
//    fd: fd (resource)
//    mode: fallocate_mode = 0x0 (8 bytes)
//    off: intptr = 0x0 (8 bytes)
//    len: intptr = 0x8800000 (8 bytes)
//  ]
	syscall(__NR_fallocate, /*fd=*/r[0], /*mode=*/0ul, /*off=*/0ul, /*len=*/0x8800000ul);
//  unlink arguments: [
//    path: ptr[in, buffer] {
//      buffer: {2e 2f 66 69 6c 65 30 2f 66 69 6c 65 30 00} (length 0xe)
//    }
//  ]
memcpy((void*)0x200000000080, "./file0/file0\000", 14);
	syscall(__NR_unlink, /*path=*/0x200000000080ul);
	return 0;
}

Based on the analysis of the bug report and the ext4 source code, here is the assessment of the security impact:

**Analysis:**
The bug is a **lockdep false positive** caused by slab object reuse without re-initializing the lockdep class. 

1. Ext4 inodes are allocated from `ext4_inode_cachep`, which uses a slab constructor (`init_once`) to initialize the `i_data_sem` rw_semaphore.
2. When an inode is used to store large extended attributes (an EA inode), `ext4_xattr_inode_set_class()` is called, which changes the lockdep subclass of `i_data_sem` to `3` (`I_DATA_SEM_EA`).
3. When the EA inode is deleted and its slab object is freed, the lockdep subclass remains `3`. If this slab object is subsequently reallocated for a *normal* file, its `i_data_sem` incorrectly retains subclass `3` because `ext4_alloc_inode()` does not re-initialize the semaphore.
4. When an unprivileged user unlinks this normal file, `do_unlinkat()` acquires the parent directory's `inode_lock` (which uses subclass `1`, `I_MUTEX_PARENT`). It then drops the last reference to the file, triggering `ext4_evict_inode()` -> `ext4_truncate()`.
5. `ext4_truncate()` acquires the file's `i_data_sem` (which is still subclass `3`). This establishes a lockdep dependency: **subclass 1 -> subclass 3**.
6. During truncation, `ext4_try_to_expand_extra_isize()` may be called, which creates a *new* EA inode. Creating the EA inode acquires its `inode_lock`, which is explicitly assigned subclass `1` by `ext4_xattr_inode_set_class()`. This establishes the reverse dependency: **subclass 3 -> subclass 1**.

Lockdep detects this cycle and emits a WARNING. However, a real deadlock is **impossible** because the two subclass `1` locks belong to completely different inodes (an existing parent directory vs. a newly created, unlinked EA inode). 

Since lockdep is a debugging tool that is disabled in production kernel builds, this WARNING will not occur in production environments. Furthermore, because a real deadlock cannot happen, there is no risk of a system hang or crash.

**Conclusion:**
The bug has **no security impact**. It cannot be exploited for memory corruption or privilege escalation, and it does not cause a Denial of Service in production builds. It can be triggered by an unprivileged user on a standard ext4 filesystem simply by setting large xattrs (to create EA inodes), deleting them, and then creating/unlinking normal files to manipulate the slab cache.

gemini-3.1-pro-preview

							input: 18449
							output: 21
							thoughts: 1342
						

**Analyzing a Syzkaller Lockdep Report in ext4**

Okay, here's what I'm seeing: A syzkaller bug report flags a "WARNING: possible circular locking dependency detected" in the ext4 filesystem. The warning specifically points to a circular dependency involving `&ei->i_data_sem/3` and `&sb->s_type->i_mutex_key#9/1`. Let's dive into the lockdep report to understand the sequence.

The report details that one process (`syz.0.57/6273`) is attempting to acquire `&sb->s_type->i_mutex_key#9/1`.  Crucially, the report shows that the task already holds `&ei->i_data_sem/3`. And, the existing dependency chain creates a circular dependency; `&ei->i_data_sem/3` depends on  `&sb->s_type->i_mutex_key#9/1`. Specifically:

1.  We have the lock being requested: `&sb->s_type->i_mutex_key#9/1`  acquired via: `ext4_xattr_inode_lookup_create`
2.  The task holding a lock: `&ei->i_data_sem/3` acquired via: `ext4_truncate`.
3.  The dependency chain is as follows: `ext4_xattr_inode_lookup_create` calls `ext4_truncate`

Now, let's assess the implications. Lockdep warnings, while often not directly exploitable, can definitely lead to deadlocks, which translates to a Denial of Service (DoS). The question becomes: is this a genuine deadlock scenario or a lockdep false positive? Even if it's a true deadlock, a DoS is still a concern.

Next, I need to understand the potential impact. Can this be triggered by an unprivileged process? The reproducer involves mounting an ext4 image using a loop device. This usually demands `CAP_SYS_ADMIN` in the initial namespace. However, if user namespaces are involved and the filesystem allows it, we could have it triggered in a user namespace with those capabilities. Hold on, ext4 is NOT user-namespace mountable (I need to confirm this quickly, though). Let's verify that quickly because if that's the case, we're likely looking at a scenario that requires significant privilege to exploit.

map[Expression:FS_USERNS_MOUNT]

map[Output:drivers/android/binderfs.c=782=static struct file_system_type binder_fs_type = {
--
drivers/android/binderfs.c-786-	.kill_sb		= binderfs_kill_super,
drivers/android/binderfs.c:787:	.fs_flags		= FS_USERNS_MOUNT,
drivers/android/binderfs.c-788-};
--
fs/binfmt_misc.c=1026=static struct file_system_type bm_fs_type = {
--
fs/binfmt_misc.c-1029-	.init_fs_context = bm_init_fs_context,
fs/binfmt_misc.c:1030:	.fs_flags	= FS_USERNS_MOUNT,
fs/binfmt_misc.c-1031-	.kill_sb	= kill_litter_super,
--
fs/devpts/inode.c=467=static struct file_system_type devpts_fs_type = {
--
fs/devpts/inode.c-471-	.kill_sb	= devpts_kill_sb,
fs/devpts/inode.c:472:	.fs_flags	= FS_USERNS_MOUNT,
fs/devpts/inode.c-473-};
--
fs/fuse/inode.c=2084=static struct file_system_type fuse_fs_type = {
--
fs/fuse/inode.c-2086-	.name		= "fuse",
fs/fuse/inode.c:2087:	.fs_flags	= FS_HAS_SUBTYPE | FS_USERNS_MOUNT | FS_ALLOW_IDMAP,
fs/fuse/inode.c-2088-	.init_fs_context = fuse_init_fs_context,
--
fs/overlayfs/params.c=751=static const struct fs_context_operations ovl_context_ops = {
--
fs/overlayfs/params.c-760- * This is called during fsopen() and will record the user namespace of
fs/overlayfs/params.c:761: * the caller in fc->user_ns since we've raised FS_USERNS_MOUNT. We'll
fs/overlayfs/params.c-762- * need it when we actually create the superblock to verify that the
--
fs/overlayfs/super.c=1514=struct file_system_type ovl_fs_type = {
--
fs/overlayfs/super.c-1518-	.parameters		= ovl_parameter_spec,
fs/overlayfs/super.c:1519:	.fs_flags		= FS_USERNS_MOUNT,
fs/overlayfs/super.c-1520-	.kill_sb		= kill_anon_super,
--
fs/proc/root.c=277=static struct file_system_type proc_fs_type = {
--
fs/proc/root.c-281-	.kill_sb		= proc_kill_sb,
fs/proc/root.c:282:	.fs_flags		= FS_USERNS_MOUNT | FS_DISALLOW_NOTIFY_PERM,
fs/proc/root.c-283-};
--
fs/ramfs/inode.c=319=static struct file_system_type ramfs_fs_type = {
--
fs/ramfs/inode.c-323-	.kill_sb	= ramfs_kill_sb,
fs/ramfs/inode.c:324:	.fs_flags	= FS_USERNS_MOUNT,
fs/ramfs/inode.c-325-};
--
fs/super.c=691=bool mount_capable(struct fs_context *fc)
fs/super.c-692-{
fs/super.c:693:	if (!(fc->fs_type->fs_flags & FS_USERNS_MOUNT))
fs/super.c-694-		return capable(CAP_SYS_ADMIN);
--
fs/super.c=731=struct super_block *sget_fc(struct fs_context *fc,
--
fs/super.c-740-	/*
fs/super.c:741:	 * Never allow s_user_ns != &init_user_ns when FS_USERNS_MOUNT is
fs/super.c-742-	 * not set, as the filesystem is likely unprepared to handle it.
--
fs/super.c-745-	 */
fs/super.c:746:	if (user_ns != &init_user_ns && !(fc->fs_type->fs_flags & FS_USERNS_MOUNT)) {
fs/super.c-747-		errorfc(fc, "VFS: Mounting from non-initial user namespace is not allowed");
--
fs/sysfs/mount.c=90=static struct file_system_type sysfs_fs_type = {
--
fs/sysfs/mount.c-93-	.kill_sb		= sysfs_kill_sb,
fs/sysfs/mount.c:94:	.fs_flags		= FS_USERNS_MOUNT,
fs/sysfs/mount.c-95-};
--
include/linux/fs.h=2671=struct file_system_type {
--
include/linux/fs.h-2676-#define FS_HAS_SUBTYPE		4
include/linux/fs.h:2677:#define FS_USERNS_MOUNT		8	/* Can be mounted by userns root */
include/linux/fs.h-2678-#define FS_DISALLOW_NOTIFY_PERM	16	/* Disable fanotify permission events */
--
ipc/mqueue.c=1638=static struct file_system_type mqueue_fs_type = {
--
ipc/mqueue.c-1641-	.kill_sb		= kill_litter_super,
ipc/mqueue.c:1642:	.fs_flags		= FS_USERNS_MOUNT,
ipc/mqueue.c-1643-};
--
kernel/bpf/inode.c=1087=static struct file_system_type bpf_fs_type = {
--
kernel/bpf/inode.c-1092-	.kill_sb	= bpf_kill_super,
kernel/bpf/inode.c:1093:	.fs_flags	= FS_USERNS_MOUNT,
kernel/bpf/inode.c-1094-};
--
kernel/cgroup/cgroup.c=2346=struct file_system_type cgroup_fs_type = {
--
kernel/cgroup/cgroup.c-2350-	.kill_sb		= cgroup_kill_sb,
kernel/cgroup/cgroup.c:2351:	.fs_flags		= FS_USERNS_MOUNT,
kernel/cgroup/cgroup.c-2352-};
--
kernel/cgroup/cgroup.c=2354=static struct file_system_type cgroup2_fs_type = {
--
kernel/cgroup/cgroup.c-2358-	.kill_sb		= cgroup_kill_sb,
kernel/cgroup/cgroup.c:2359:	.fs_flags		= FS_USERNS_MOUNT,
kernel/cgroup/cgroup.c-2360-};
--
kernel/cgroup/cgroup.c=2427=static struct file_system_type cpuset_fs_type = {
--
kernel/cgroup/cgroup.c-2430-	.parameters		= cpuset_fs_parameters,
kernel/cgroup/cgroup.c:2431:	.fs_flags		= FS_USERNS_MOUNT,
kernel/cgroup/cgroup.c-2432-};
--
mm/shmem.c=5391=static struct file_system_type shmem_fs_type = {
--
mm/shmem.c-5398-	.kill_sb	= kill_litter_super,
mm/shmem.c:5399:	.fs_flags	= FS_USERNS_MOUNT | FS_ALLOW_IDMAP | FS_MGTIME,
mm/shmem.c-5400-};
--
mm/shmem.c=5801=static struct file_system_type shmem_fs_type = {
--
mm/shmem.c-5805-	.kill_sb	= ramfs_kill_sb,
mm/shmem.c:5806:	.fs_flags	= FS_USERNS_MOUNT,
mm/shmem.c-5807-};
]

gemini-3.1-pro-preview

							input: 22535
							output: 47
							thoughts: 1991
						

**Analyzing the Ext4 Xattr Locking Issue**

Okay, so I'm looking at this ext4 bug and initially thought it was confined to crafted images due to the lack of `FS_USERNS_MOUNT`, making it inaccessible from unprivileged processes. However, the reproducer's reliance on a crafted image piqued my interest – can we hit this on a vanilla ext4 filesystem? Time to re-examine that lockdep report.

The report highlights a potential lock order reversal issue. Stack #1 involves `ext4_xattr_set`, acquiring `&ei->i_data_sem` through a chain of function calls. Specifically: `ext4_xattr_set` -> `ext4_xattr_set_handle` -> `ext4_xattr_ibody_set` -> `ext4_xattr_inode_lookup_create` -> `ext4_xattr_inode_write`. Crucially, `ext4_xattr_inode_write` seems to take `&ei->i_data_sem` *of the EA inode*, not the original inode, which is critical. The lock class is confirmed as `&ei->i_data_sem/3`.

Now, consider Stack #0: `ext4_truncate` takes `&ei->i_data_sem` via the call chain `ext4_truncate` -> `ext4_ext_truncate` -> `__ext4_mark_inode_dirty` -> `ext4_try_to_expand_extra_isize` -> `ext4_expand_extra_isize_ea` -> `ext4_xattr_make_inode_space` -> `ext4_xattr_move_to_block` -> `ext4_xattr_block_set` -> `ext4_xattr_inode_lookup_create` -> `ext4_xattr_inode_create`. And this last call, `ext4_xattr_inode_create`, acquires `inode_lock`, which is identified as `&sb->s_type->i_mutex_key#9/1` of the *newly* created EA inode.

So, the lock dependency here is: `&ei->i_data_sem/3` -> `&sb->s_type->i_mutex_key#9/1`. But what about the *first* stack? In that context, `vfs_setxattr` *first* takes `inode_lock` (specifically, of the original inode) before calling `ext4_xattr_set`, which then calls `ext4_xattr_inode_lookup_create`. This function then calls `ext4_xattr_inode_write`, taking the `&ei->i_data_sem` of the *EA inode*. The lockdep report confirms the relevant `vfs_setxattr` call chain: `vfs_setxattr` -> `ext4_xattr_set` -> `ext4_xattr_set_handle` -> `ext4_xattr_ibody_set` -> `ext4_xattr_inode_lookup_create` -> `ext4_xattr_inode_write`.

This means the original inode lock is acquired *before* acquiring the EA inode's lock. However, `ext4_xattr_inode_create` is called in the second stack. I need to understand that. Where is `&sb->s_type->i_mutex_key#9/1` taken in the *first* stack? Time to carefully examine `ext4_xattr_inode_create`.

map[ContextFile:fs/ext4/xattr.c IncludeLines:true Name:ext4_xattr_inode_create]

map[SourceCode:1457:	/*
1458:	 * Create an inode to store the value of a large EA.
1459:	 */
1460:	static struct inode *ext4_xattr_inode_create(handle_t *handle,
1461:						     struct inode *inode, u32 hash)
1462:	{
1463:		struct inode *ea_inode = NULL;
1464:		uid_t owner[2] = { i_uid_read(inode), i_gid_read(inode) };
1465:		int err;
1466:	
1467:		if (inode->i_sb->s_root == NULL) {
1468:			ext4_warning(inode->i_sb,
1469:				     "refuse to create EA inode when umounting");
1470:			WARN_ON(1);
1471:			return ERR_PTR(-EINVAL);
1472:		}
1473:	
1474:		/*
1475:		 * Let the next inode be the goal, so we try and allocate the EA inode
1476:		 * in the same group, or nearby one.
1477:		 */
1478:		ea_inode = ext4_new_inode(handle, inode->i_sb->s_root->d_inode,
1479:					  S_IFREG | 0600, NULL, inode->i_ino + 1, owner,
1480:					  EXT4_EA_INODE_FL);
1481:		if (!IS_ERR(ea_inode)) {
1482:			ea_inode->i_op = &ext4_file_inode_operations;
1483:			ea_inode->i_fop = &ext4_file_operations;
1484:			ext4_set_aops(ea_inode);
1485:			ext4_xattr_inode_set_class(ea_inode);
1486:			unlock_new_inode(ea_inode);
1487:			ext4_xattr_inode_set_ref(ea_inode, 1);
1488:			ext4_xattr_inode_set_hash(ea_inode, hash);
1489:			err = ext4_mark_inode_dirty(handle, ea_inode);
1490:			if (!err)
1491:				err = ext4_inode_attach_jinode(ea_inode);
1492:			if (err) {
1493:				if (ext4_xattr_inode_dec_ref(handle, ea_inode))
1494:					ext4_warning_inode(ea_inode,
1495:						"cleanup dec ref error %d", err);
1496:				iput(ea_inode);
1497:				return ERR_PTR(err);
1498:			}
1499:	
1500:			/*
1501:			 * Xattr inodes are shared therefore quota charging is performed
1502:			 * at a higher level.
1503:			 */
1504:			dquot_free_inode(ea_inode);
1505:			dquot_drop(ea_inode);
1506:			inode_lock(ea_inode);
1507:			ea_inode->i_flags |= S_NOQUOTA;
1508:			inode_unlock(ea_inode);
1509:		}
1510:	
1511:		return ea_inode;
1512:	}
 SourceFile:fs/ext4/xattr.c]

gemini-3.1-pro-preview

							input: 26300
							output: 49
							thoughts: 95
						

Here's my analysis of the code, presented as a summary of my thought process:

**Diving into ext4 Xattr Locking**

Okay, so I'm seeing that `inode_lock(ea_inode)` is called within `ext4_xattr_inode_create`. That's standard practice, of course, protecting the inode during xattr creation. Now, let's see what we've got in front of us. Aha, the lock class of `ea_inode` is identified as `&sb->s_type->i_mutex_key#9/1`. Right, that makes sense – we're likely using a standard mutex for this.

Wait a second...I'm catching that `ext4_xattr_inode_set_class(ea_inode)` is called *before* we grab that lock with `inode_lock(ea_inode)`. That's worth a closer look. I need to understand what `ext4_xattr_inode_set_class` is doing here. It's likely involved in setting up or modifying the lock class itself, maybe depending on some configuration. I need to examine what's happening within that function to understand the whole picture.

map[ContextFile:fs/ext4/xattr.c IncludeLines:true Name:ext4_xattr_inode_set_class]

map[SourceCode: 122:	void ext4_xattr_inode_set_class(struct inode *ea_inode)
 123:	{
 124:		struct ext4_inode_info *ei = EXT4_I(ea_inode);
 125:	
 126:		lockdep_set_subclass(&ea_inode->i_rwsem, 1);
 127:		(void) ei;	/* shut up clang warning if !CONFIG_LOCKDEP */
 128:		lockdep_set_subclass(&ei->i_data_sem, I_DATA_SEM_EA);
 129:	}
 SourceFile:fs/ext4/xattr.c]

gemini-3.1-pro-preview

							input: 26894
							output: 21
							thoughts: 55
						

Okay, here's my interpretation of these thoughts, playing the role of someone familiar with kernel data structures and concurrency mechanisms:

**Analyzing Semaphore Usage in Extended Attribute Operations**

Alright, let's break this down. It seems we're dealing with semaphore usage, likely within a filesystem context, and specifically around extended attributes (EAs). The first point indicates `ea_inode->i_rwsem` belongs to subclass 1. This likely signifies a read-write semaphore associated with the inode itself, controlling concurrent access to its metadata or other inode related information. That tracks.

Now, the second part of this thought trail is interesting. It indicates that `ei->i_data_sem` belongs to the `I_DATA_SEM_EA` subclass. My immediate thought is, "Okay, what's `I_DATA_SEM_EA`?" It strongly implies that there is a distinct semaphore structure that exists separate from the inode semaphore, perhaps to manage concurrency specifically within the EA data itself, so I'm making a mental note to check the definition of that constant or enum member to understand the exact granularity of the locking. Is this per-inode? per-EA? per-attribute? Knowing the semantic difference between these locks is critical for understanding the concurrency guarantees, how these locks are expected to behave, and to avoid introducing deadlocks.

map[Expression:I_DATA_SEM_EA]

map[Output:fs/ext4/ext4.h=956=do {										\
--
fs/ext4/ext4.h-1009- *  I_DATA_SEM_QUOTA  - Used for quota inodes only
fs/ext4/ext4.h:1010: *  I_DATA_SEM_EA     - Used for ea_inodes only
fs/ext4/ext4.h-1011- */
fs/ext4/ext4.h=1012=enum {
--
fs/ext4/ext4.h-1015-	I_DATA_SEM_QUOTA,
fs/ext4/ext4.h:1016:	I_DATA_SEM_EA
fs/ext4/ext4.h-1017-};
--
fs/ext4/xattr.c=122=void ext4_xattr_inode_set_class(struct inode *ea_inode)
--
fs/ext4/xattr.c-127-	(void) ei;	/* shut up clang warning if !CONFIG_LOCKDEP */
fs/ext4/xattr.c:128:	lockdep_set_subclass(&ei->i_data_sem, I_DATA_SEM_EA);
fs/ext4/xattr.c-129-}
]

gemini-3.1-pro-preview

							input: 27581
							output: 49
							thoughts: 314
						

**Analyzing the Ext4 Extended Attribute Lock Dep Report**

Okay, so `I_DATA_SEM_EA` is equal to 3. This means that when we see `&ei->i_data_sem/3`, that's the `i_data_sem` of the EA inode. Let me double-check that lockdep report… aha!

```
-> #1 (&ei->i_data_sem/3){++++}-{4:4}:
       ...
       ext4_xattr_inode_write fs/ext4/xattr.c:1444 [inline]
       ext4_xattr_inode_lookup_create+0x14d1/0x1c20 fs/ext4/xattr.c:1594
```

Right, `ext4_xattr_inode_write` is indeed taking `&ei->i_data_sem/3`, which we established is the EA inode's `i_data_sem`. But here's where it gets interesting... In the `ext4_xattr_inode_create` function, it grabs `inode_lock(ea_inode)`. Now, I recall that's associated with `&sb->s_type->i_mutex_key#9/1`, meaning it's subclassed as 1. So, within `ext4_xattr_inode_create`, we're dealing with `inode_lock(ea_inode)` and its subclass (1).

But, `ext4_xattr_inode_create` is called from `ext4_xattr_inode_lookup_create`. Time to revisit that function and see what's happening in its scope.

map[ContextFile:fs/ext4/xattr.c IncludeLines:true Name:ext4_xattr_inode_lookup_create]

map[SourceCode:1563:	/*
1564:	 * Add value of the EA in an inode.
1565:	 */
1566:	static struct inode *ext4_xattr_inode_lookup_create(handle_t *handle,
1567:			struct inode *inode, const void *value, size_t value_len)
1568:	{
1569:		struct inode *ea_inode;
1570:		u32 hash;
1571:		int err;
1572:	
1573:		/* Account inode & space to quota even if sharing... */
1574:		err = ext4_xattr_inode_alloc_quota(inode, value_len);
1575:		if (err)
1576:			return ERR_PTR(err);
1577:	
1578:		hash = ext4_xattr_inode_hash(EXT4_SB(inode->i_sb), value, value_len);
1579:		ea_inode = ext4_xattr_inode_cache_find(inode, value, value_len, hash);
1580:		if (ea_inode) {
1581:			err = ext4_xattr_inode_inc_ref(handle, ea_inode);
1582:			if (err)
1583:				goto out_err;
1584:			return ea_inode;
1585:		}
1586:	
1587:		/* Create an inode for the EA value */
1588:		ea_inode = ext4_xattr_inode_create(handle, inode, hash);
1589:		if (IS_ERR(ea_inode)) {
1590:			ext4_xattr_inode_free_quota(inode, NULL, value_len);
1591:			return ea_inode;
1592:		}
1593:	
1594:		err = ext4_xattr_inode_write(handle, ea_inode, value, value_len);
1595:		if (err) {
1596:			if (ext4_xattr_inode_dec_ref(handle, ea_inode))
1597:				ext4_warning_inode(ea_inode, "cleanup dec ref error %d", err);
1598:			goto out_err;
1599:		}
1600:	
1601:		if (EA_INODE_CACHE(inode))
1602:			mb_cache_entry_create(EA_INODE_CACHE(inode), GFP_NOFS, hash,
1603:					      ea_inode->i_ino, true /* reusable */);
1604:		return ea_inode;
1605:	out_err:
1606:		iput(ea_inode);
1607:		ext4_xattr_inode_free_quota(inode, NULL, value_len);
1608:		return ERR_PTR(err);
1609:	}
 SourceFile:fs/ext4/xattr.c]

gemini-3.1-pro-preview

							input: 29118
							output: 49
							thoughts: 3853
						

**Analysis of Potential Lockdep Warning in ext4 Xattr Handling**

Alright, let's break this down. My initial thought process revolves around a lockdep report highlighting a potential circular dependency in the ext4 extended attribute (xattr) handling code. The core issue seems to stem from interactions between `ext4_xattr_inode_lookup_create`, `ext4_xattr_inode_create`, and `ext4_xattr_inode_write`, specifically concerning the acquisition of `inode_lock` and the `i_data_sem` semaphore associated with extended attribute inodes (EA inodes).

First, I identified that `ext4_xattr_inode_lookup_create` calls `ext4_xattr_inode_create`, which initially takes and releases `inode_lock(ea_inode)`. Then, it calls `ext4_xattr_inode_write`, which takes `&ei->i_data_sem` of `ea_inode`. The initial lock acquisition and release in `ext4_xattr_inode_create` seemed unusual, but it’s correct.

The lockdep report itself pointed to a dependency chain involving `&ei->i_data_sem/3` and `&sb->s_type->i_mutex_key#9/1`. The critical point here is the distinction between lock *classes* and *subclasses*. `inode_lock` of the original inode is a different lock *class* (subclass 0), and when acquiring `inode_lock` of an EA inode, it is subclass 1. The EA inode's `i_data_sem` has subclass 3.

I traced the dependency: `vfs_setxattr` takes `inode_lock` of the original inode. `ext4_xattr_inode_write` takes `&ei->i_data_sem/3`. This establishes a dependency between `&sb->s_type->i_mutex_key#9` (subclass 0), and `&ei->i_data_sem/3`. However, the lockdep report actually said the reverse, specifically `&sb->s_type->i_mutex_key#9/1` -> `&ei->i_data_sem/3`.

This led me to explore where the lock dependency could be established. My conclusion was `vfs_setxattr` on an EA inode would hold subclass 1 and then take subclass 3. Then, I considered the scenario in the lockdep report, where `ext4_truncate` (triggered by eviction of an EA inode) is holding `&ei->i_data_sem/3`.

The crucial insight was recognizing that `ext4_truncate` on an EA inode can call a sequence of functions that ultimately involves creating a NEW EA inode. In this case, `ext4_truncate` calls `ext4_xattr_inode_lookup_create`, and `ext4_xattr_inode_create`, which takes `inode_lock` of this new EA inode. At this point, `ext4_truncate` holds the `i_data_sem` of the *evicted* EA inode and *also* attempts to acquire `inode_lock` on a *new* EA inode. This generates the circular dependency as reported by lockdep: `&ei->i_data_sem/3` -> `&sb->s_type->i_mutex_key#9/1`.

Then the thought occurred to me that this circular dependency is triggered by setting extended attributes on an EA inode, and subsequently unlinking it.

This led me to consider the specific steps which would lead to a possible deadlock, which would involve two threads and two different EA inodes. But the lockdep report warns about circular dependencies between *classes*, which would happen with the subclasses on the two different locks as indicated above:
Subclass 1 -> Subclass 3 (from `setxattr` on EA inode)
Subclass 3 -> Subclass 1 (from `evict` on EA inode)

The next step would be to determine the practical implications: can this be a false positive or is it a true deadlock?
Finally, I concluded that a crafted ext4 image, which exposes an EA inode as a "regular" file, is required to trigger this lockdep warning.

map[ContextFile:fs/ext4/xattr.c IncludeLines:true Name:ext4_xattr_inode_lookup_create]

map[SourceCode:1563:	/*
1564:	 * Add value of the EA in an inode.
1565:	 */
1566:	static struct inode *ext4_xattr_inode_lookup_create(handle_t *handle,
1567:			struct inode *inode, const void *value, size_t value_len)
1568:	{
1569:		struct inode *ea_inode;
1570:		u32 hash;
1571:		int err;
1572:	
1573:		/* Account inode & space to quota even if sharing... */
1574:		err = ext4_xattr_inode_alloc_quota(inode, value_len);
1575:		if (err)
1576:			return ERR_PTR(err);
1577:	
1578:		hash = ext4_xattr_inode_hash(EXT4_SB(inode->i_sb), value, value_len);
1579:		ea_inode = ext4_xattr_inode_cache_find(inode, value, value_len, hash);
1580:		if (ea_inode) {
1581:			err = ext4_xattr_inode_inc_ref(handle, ea_inode);
1582:			if (err)
1583:				goto out_err;
1584:			return ea_inode;
1585:		}
1586:	
1587:		/* Create an inode for the EA value */
1588:		ea_inode = ext4_xattr_inode_create(handle, inode, hash);
1589:		if (IS_ERR(ea_inode)) {
1590:			ext4_xattr_inode_free_quota(inode, NULL, value_len);
1591:			return ea_inode;
1592:		}
1593:	
1594:		err = ext4_xattr_inode_write(handle, ea_inode, value, value_len);
1595:		if (err) {
1596:			if (ext4_xattr_inode_dec_ref(handle, ea_inode))
1597:				ext4_warning_inode(ea_inode, "cleanup dec ref error %d", err);
1598:			goto out_err;
1599:		}
1600:	
1601:		if (EA_INODE_CACHE(inode))
1602:			mb_cache_entry_create(EA_INODE_CACHE(inode), GFP_NOFS, hash,
1603:					      ea_inode->i_ino, true /* reusable */);
1604:		return ea_inode;
1605:	out_err:
1606:		iput(ea_inode);
1607:		ext4_xattr_inode_free_quota(inode, NULL, value_len);
1608:		return ERR_PTR(err);
1609:	}
 SourceFile:fs/ext4/xattr.c]

gemini-3.1-pro-preview

							input: 34742
							output: 46
							thoughts: 2008
						

**My Analysis of the Lockdep Warning in ext4 Xattr Handling**

Okay, so here's the deal. I'm looking at this lockdep warning related to extended attributes (xattrs) in the ext4 filesystem. My initial thought is that it's probably a false positive, and here's why.

First, the code checks the xattr inode cache. If it finds an existing EA (extended attribute) inode, it just increments the reference count. *Critically*, it *doesn't* take any locks like `inode_lock` at that point. I see that `ext4_xattr_inode_write` gets called *only* if a *new* EA inode is created. I have to remember that because that's important later.

So, if an EA inode (let's call it EA1) is *already* in the cache, no lock is acquired on it. It seems like the code doesn't take `inode_lock` or `i_data_sem` on an already existing inode. `ext4_xattr_inode_write` *does* take `i_data_sem` but only for new EA inodes.

This means that a second thread (Thread B, perhaps evicting EA2) isn't going to try to take `inode_lock(EA3)` unless EA3 is brand new. Because EA3 is newly created, no other thread could *possibly* be holding that lock. That's good. Since the inode is newly created, this completely eliminates the possibility of a real deadlock.

But the bug report says it's a *WARNING*. I know that lockdep is disabled in production kernels, so this warning won't cause a panic or a crash. So, what *is* the potential impact?

I need to confirm there's no other real bug here that might be exploitable. Could a user somehow craft a malicious ext4 image and cause memory corruption? The warning is specific to the lockdep issue.

Okay, can an unprivileged user even trigger this? Mounting an ext4 filesystem usually needs `CAP_SYS_ADMIN` in the initial namespace. But wait, if someone plugs in a malicious USB drive, a desktop environment might auto-mount it. *That* could trigger this, since udisks2 runs as root and handles the mount. So, "Peripheral Trigger" and "Malicious Filesystem Trigger" are looking like they're true.

But is this a Denial of Service (DoS)? Because lockdep is off in production, and no deadlock is possible, it's not. No crash, no deadlock, nothing.

Let's trace it out carefully to be absolutely sure.
*   **Thread A:** `setxattr` on EA1.  It holds `inode_lock(EA1)`. Calls `ext4_xattr_set_handle` -> `ext4_xattr_inode_lookup_create`. EA2 gets created.  It takes `inode_lock(EA2)` in `ext4_xattr_inode_create`. It releases it right away. Then it takes `i_data_sem(EA2)` in `ext4_xattr_inode_write`. And releases it.
*   **Thread B:** `evict` on EA2. It takes `i_data_sem(EA2)` in `ext4_truncate`.  It calls `ext4_try_to_expand_extra_isize` -> `ext4_xattr_inode_lookup_create`. EA3 gets created. It takes `inode_lock(EA3)` in `ext4_xattr_inode_create`.  Then it releases it.  Then it takes `i_data_sem(EA3)` in `ext4_xattr_inode_write`. And releases it.

Where's the deadlock? Thread A holds a lock and waits for a lock that Thread B holds. Thread B holds a lock and waits for a lock that Thread A holds. For a deadlock to happen. Thread A holds `inode_lock(EA1)` and should wait for `i_data_sem(EA2)`. But wait a minute, the code never takes `i_data_sem(EA2)` if EA2 is newly created. It only does this if EA2 is already cached, which means that `ext4_xattr_inode_lookup_create` did *not* have to take the `i_data_sem`. It just increments the refcount. It doesn't. And `ext4_xattr_inode_write` is *only* called if EA2 is *new*. So Thread A never waits.
Thread B holds `i_data_sem(EA2)` and should wait for `inode_lock(EA3)`. But EA3 is

map[ContextFile:fs/ext4/export.c IncludeLines:true Name:ext4_fh_to_dentry]

map[SourceCode:1536:	static struct dentry *ext4_fh_to_dentry(struct super_block *sb, struct fid *fid,
1537:						int fh_len, int fh_type)
1538:	{
1539:		return generic_fh_to_dentry(sb, fid, fh_len, fh_type,
1540:					    ext4_nfs_get_inode);
1541:	}
 SourceFile:fs/ext4/super.c]

gemini-3.1-pro-preview

							input: 37966
							output: 46
							thoughts: 15
						

Here's my attempt at summarizing the thought process, tailored for an expert audience and written in the first person:

**Diving into `ext4_nfs_get_inode`**

Okay, let's zero in on `ext4_nfs_get_inode`. I need to refresh my understanding of how NFS interacts with the ext4 filesystem at the inode level. Specifically, I want to see how the system handles the complexities of NFS requests and translates them into ext4 operations. I'm thinking about the potential bottlenecks here. Is there something problematic with the current implementation? Or am I just not seeing it?

I need to quickly remember the typical NFS lookup process – how the NFS server handles a lookup request, what the arguments mean, and how this particular function is involved. Is it the main entry point for inode lookups? Does it provide any special handling, potentially caching or validation, for NFS clients? I want to understand if it's operating efficiently within the overall NFS flow, especially concerning the metadata path. Any potential issues with locking or concurrency that I should consider?

Let's see if there is anything that stands out as unusual or inefficient.

map[ContextFile:fs/ext4/super.c IncludeLines:true Name:ext4_nfs_get_inode]

map[SourceCode:1516:	static struct inode *ext4_nfs_get_inode(struct super_block *sb,
1517:						u64 ino, u32 generation)
1518:	{
1519:		struct inode *inode;
1520:	
1521:		/*
1522:		 * Currently we don't know the generation for parent directory, so
1523:		 * a generation of 0 means "accept any"
1524:		 */
1525:		inode = ext4_iget(sb, ino, EXT4_IGET_HANDLE);
1526:		if (IS_ERR(inode))
1527:			return ERR_CAST(inode);
1528:		if (generation && inode->i_generation != generation) {
1529:			iput(inode);
1530:			return ERR_PTR(-ESTALE);
1531:		}
1532:	
1533:		return inode;
1534:	}
 SourceFile:fs/ext4/super.c]

gemini-3.1-pro-preview

							input: 38563
							output: 41
							thoughts: 23
						

Here's my thought process, as if I were considering this issue:

**Investigating Potential EA Inode Rejection by `ext4_iget`**

Okay, hold on a second. I'm having a hunch here, and it's making me re-evaluate my current line of thinking. It suddenly strikes me that `ext4_iget`, that cornerstone of inode retrieval in the ext4 filesystem, might actually be the one rejecting Extended Attribute (EA) inodes under certain circumstances. Before I go further down this path, and assuming my initial assumptions are sound, let's stop and verify this by digging into the code of `ext4_iget`. I need to ensure my assumptions about how inodes are handled are correct. Let's see what's really happening within `ext4_iget`.

requested entity does not exist

map[ContextFile:fs/ext4/inode.c IncludeLines:true Name:ext4_iget]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 38816
							output: 18
							thoughts: 22
						

Here's my thought process, summarized as you requested:

**Ext4 Inode Retrieval Investigation**

Okay, so I need to understand how the `ext4` filesystem retrieves inodes. Let's start with a focused search. My instinct is that I need to pinpoint the function responsible for getting an inode, likely by its number. That naturally leads me to think about searching for `ext4_iget`. I'm going to head directly to the heart of the matter – the `fs/ext4/inode.c` file. This is where I would expect the core inode management functions for ext4 to reside. I'm focusing my search there to avoid a shotgun approach and to hone in on the code that directly pertains to inode retrieval within the ext4 implementation. Let's see what we can find.

map[Expression:ext4_iget]

map[Output:fs/ext4/block_validity.c=147=static int ext4_protect_reserved_inode(struct super_block *sb,
--
fs/ext4/block_validity.c-159-		return -EINVAL;
fs/ext4/block_validity.c:160:	inode = ext4_iget(sb, ino, EXT4_IGET_SPECIAL);
fs/ext4/block_validity.c-161-	if (IS_ERR(inode))
--
fs/ext4/ext4.h=2861=static inline void ext4_update_dx_flag(struct inode *inode)
--
fs/ext4/ext4.h-2864-	    ext4_test_inode_flag(inode, EXT4_INODE_INDEX)) {
fs/ext4/ext4.h:2865:		/* ext4_iget() should have caught this... */
fs/ext4/ext4.h-2866-		WARN_ON_ONCE(ext4_has_feature_metadata_csum(inode->i_sb));
--
fs/ext4/ext4.h=3009=typedef enum {
--
fs/ext4/ext4.h-3014-	EXT4_IGET_EA_INODE =	0x0008	/* Inode should contain an EA value */
fs/ext4/ext4.h:3015:} ext4_iget_flags;
fs/ext4/ext4.h-3016-
fs/ext4/ext4.h:3017:extern struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
fs/ext4/ext4.h:3018:				 ext4_iget_flags flags, const char *function,
fs/ext4/ext4.h-3019-				 unsigned int line);
fs/ext4/ext4.h-3020-
fs/ext4/ext4.h:3021:#define ext4_iget(sb, ino, flags) \
fs/ext4/ext4.h:3022:	__ext4_iget((sb), (ino), (flags), __func__, __LINE__)
fs/ext4/ext4.h-3023-
--
fs/ext4/fast_commit.c=1400=static int ext4_fc_replay_unlink(struct super_block *sb,
--
fs/ext4/fast_commit.c-1414-	entry.len = darg.dname_len;
fs/ext4/fast_commit.c:1415:	inode = ext4_iget(sb, darg.ino, EXT4_IGET_NORMAL);
fs/ext4/fast_commit.c-1416-
--
fs/ext4/fast_commit.c-1421-
fs/ext4/fast_commit.c:1422:	old_parent = ext4_iget(sb, darg.parent_ino,
fs/ext4/fast_commit.c-1423-				EXT4_IGET_NORMAL);
--
fs/ext4/fast_commit.c=1439=static int ext4_fc_replay_link_internal(struct super_block *sb,
--
fs/ext4/fast_commit.c-1447-
fs/ext4/fast_commit.c:1448:	dir = ext4_iget(sb, darg->parent_ino, EXT4_IGET_NORMAL);
fs/ext4/fast_commit.c-1449-	if (IS_ERR(dir)) {
--
fs/ext4/fast_commit.c=1498=static int ext4_fc_replay_link(struct super_block *sb,
--
fs/ext4/fast_commit.c-1508-
fs/ext4/fast_commit.c:1509:	inode = ext4_iget(sb, darg.ino, EXT4_IGET_NORMAL);
fs/ext4/fast_commit.c-1510-	if (IS_ERR(inode)) {
--
fs/ext4/fast_commit.c=1553=static int ext4_fc_replay_inode(struct super_block *sb,
--
fs/ext4/fast_commit.c-1569-
fs/ext4/fast_commit.c:1570:	inode = ext4_iget(sb, ino, EXT4_IGET_NORMAL);
fs/ext4/fast_commit.c-1571-	if (!IS_ERR(inode)) {
--
fs/ext4/fast_commit.c-1619-	/* Given that we just wrote the inode on disk, this SHOULD succeed. */
fs/ext4/fast_commit.c:1620:	inode = ext4_iget(sb, ino, EXT4_IGET_NORMAL);
fs/ext4/fast_commit.c-1621-	if (IS_ERR(inode)) {
--
fs/ext4/fast_commit.c=1656=static int ext4_fc_replay_create(struct super_block *sb,
--
fs/ext4/fast_commit.c-1673-
fs/ext4/fast_commit.c:1674:	inode = ext4_iget(sb, darg.ino, EXT4_IGET_NORMAL);
fs/ext4/fast_commit.c-1675-	if (IS_ERR(inode)) {
--
fs/ext4/fast_commit.c-1686-		 */
fs/ext4/fast_commit.c:1687:		dir = ext4_iget(sb, darg.parent_ino, EXT4_IGET_NORMAL);
fs/ext4/fast_commit.c-1688-		if (IS_ERR(dir)) {
--
fs/ext4/fast_commit.c=1754=static int ext4_fc_replay_add_range(struct super_block *sb,
--
fs/ext4/fast_commit.c-1773-
fs/ext4/fast_commit.c:1774:	inode = ext4_iget(sb, le32_to_cpu(fc_add_ex.fc_ino), EXT4_IGET_NORMAL);
fs/ext4/fast_commit.c-1775-	if (IS_ERR(inode)) {
--
fs/ext4/fast_commit.c=1875=ext4_fc_replay_del_range(struct super_block *sb,
--
fs/ext4/fast_commit.c-1890-
fs/ext4/fast_commit.c:1891:	inode = ext4_iget(sb, le32_to_cpu(lrange.fc_ino), EXT4_IGET_NORMAL);
fs/ext4/fast_commit.c-1892-	if (IS_ERR(inode)) {
--
fs/ext4/fast_commit.c=1936=static void ext4_fc_set_bitmaps_and_counters(struct super_block *sb)
--
fs/ext4/fast_commit.c-1946-	for (i = 0; i < state->fc_modified_inodes_used; i++) {
fs/ext4/fast_commit.c:1947:		inode = ext4_iget(sb, state->fc_modified_inodes[i],
fs/ext4/fast_commit.c-1948-			EXT4_IGET_NORMAL);
--
fs/ext4/ialloc.c=1367=struct inode *ext4_orphan_get(struct super_block *sb, unsigned long ino)
--
fs/ext4/ialloc.c-1391-
fs/ext4/ialloc.c:1392:	inode = ext4_iget(sb, ino, EXT4_IGET_NORMAL);
fs/ext4/ialloc.c-1393-	if (IS_ERR(inode)) {
--
fs/ext4/inline.c=111=int ext4_get_max_inline_size(struct inode *inode)
--
fs/ext4/inline.c-140- * this function does not take xattr_sem, which is OK because it is
fs/ext4/inline.c:141: * currently only used in a code path coming form ext4_iget, before
fs/ext4/inline.c-142- * the new inode has been unlocked
--
fs/ext4/inode.c=5070=static blkcnt_t ext4_inode_blocks(struct ext4_inode *raw_inode,
--
fs/ext4/inode.c-5091-
fs/ext4/inode.c:5092:static inline int ext4_iget_extra_inode(struct inode *inode,
fs/ext4/inode.c-5093-					 struct ext4_inode *raw_inode,
--
fs/ext4/inode.c=5131=static inline void ext4_inode_set_iversion_queried(struct inode *inode, u64 val)
--
fs/ext4/inode.c-5138-
fs/ext4/inode.c:5139:static int check_igot_inode(struct inode *inode, ext4_iget_flags flags,
fs/ext4/inode.c-5140-			    const char *function, unsigned int line)
--
fs/ext4/inode.c=5202=void ext4_set_inode_mapping_order(struct inode *inode)
--
fs/ext4/inode.c-5210-
fs/ext4/inode.c:5211:struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
fs/ext4/inode.c:5212:			  ext4_iget_flags flags, const char *function,
fs/ext4/inode.c-5213-			  unsigned int line)
--
fs/ext4/inode.c-5424-		} else {
fs/ext4/inode.c:5425:			ret = ext4_iget_extra_inode(inode, raw_inode, ei);
fs/ext4/inode.c-5426-			if (ret)
--
fs/ext4/ioctl.c=371=static long swap_inode_boot_loader(struct super_block *sb,
--
fs/ext4/ioctl.c-382-
fs/ext4/ioctl.c:383:	inode_bl = ext4_iget(sb, EXT4_BOOT_LOADER_INO,
fs/ext4/ioctl.c-384-			EXT4_IGET_SPECIAL | EXT4_IGET_BAD);
--
fs/ext4/namei.c=1762=static struct dentry *ext4_lookup(struct inode *dir, struct dentry *dentry, unsigned int flags)
--
fs/ext4/namei.c-1786-		}
fs/ext4/namei.c:1787:		inode = ext4_iget(dir->i_sb, ino, EXT4_IGET_NORMAL);
fs/ext4/namei.c-1788-		if (inode == ERR_PTR(-ESTALE)) {
--
fs/ext4/namei.c=1818=struct dentry *ext4_get_parent(struct dentry *child)
--
fs/ext4/namei.c-1837-
fs/ext4/namei.c:1838:	return d_obtain_alias(ext4_iget(child->d_sb, ino, EXT4_IGET_NORMAL));
fs/ext4/namei.c-1839-}
--
fs/ext4/orphan.c=570=int ext4_init_orphan_info(struct super_block *sb)
--
fs/ext4/orphan.c-584-
fs/ext4/orphan.c:585:	inode = ext4_iget(sb, orphan_ino, EXT4_IGET_SPECIAL);
fs/ext4/orphan.c-586-	if (IS_ERR(inode)) {
--
fs/ext4/resize.c=1701=int ext4_group_add(struct super_block *sb, struct ext4_new_group_data *input)
--
fs/ext4/resize.c-1738-		}
fs/ext4/resize.c:1739:		inode = ext4_iget(sb, EXT4_RESIZE_INO, EXT4_IGET_SPECIAL);
fs/ext4/resize.c-1740-		if (IS_ERR(inode)) {
--
fs/ext4/resize.c=1997=int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count)
--
fs/ext4/resize.c-2080-		if (!resize_inode)
fs/ext4/resize.c:2081:			resize_inode = ext4_iget(sb, EXT4_RESIZE_INO,
fs/ext4/resize.c-2082-						 EXT4_IGET_SPECIAL);
--
fs/ext4/super.c=1516=static struct inode *ext4_nfs_get_inode(struct super_block *sb,
--
fs/ext4/super.c-1524-	 */
fs/ext4/super.c:1525:	inode = ext4_iget(sb, ino, EXT4_IGET_HANDLE);
fs/ext4/super.c-1526-	if (IS_ERR(inode))
--
fs/ext4/super.c=5247=static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)
--
fs/ext4/super.c-5503-
fs/ext4/super.c:5504:	root = ext4_iget(sb, EXT4_ROOT_INO, EXT4_IGET_SPECIAL);
fs/ext4/super.c-5505-	if (IS_ERR(root)) {
--
fs/ext4/super.c=5790=static struct inode *ext4_get_journal_inode(struct super_block *sb,
--
fs/ext4/super.c-5799-	 */
fs/ext4/super.c:5800:	journal_inode = ext4_iget(sb, journal_inum, EXT4_IGET_SPECIAL);
fs/ext4/super.c-5801-	if (IS_ERR(journal_inode)) {
--
fs/ext4/super.c=7106=static int ext4_quota_enable(struct super_block *sb, int type, int format_id,
--
fs/ext4/super.c-7127-
fs/ext4/super.c:7128:	qf_inode = ext4_iget(sb, qf_inums[type], EXT4_IGET_SPECIAL);
fs/ext4/super.c-7129-	if (IS_ERR(qf_inode)) {
--
fs/ext4/xattr.c=420=static int ext4_xattr_inode_iget(struct inode *parent, unsigned long ea_ino,
--
fs/ext4/xattr.c-436-
fs/ext4/xattr.c:437:	inode = ext4_iget(parent->i_sb, ea_ino, EXT4_IGET_EA_INODE);
fs/ext4/xattr.c-438-	if (IS_ERR(inode)) {
--
fs/ext4/xattr.c=1515=ext4_xattr_inode_cache_find(struct inode *inode, const void *value,
--
fs/ext4/xattr.c-1539-	while (ce) {
fs/ext4/xattr.c:1540:		ea_inode = ext4_iget(inode->i_sb, ce->e_value,
fs/ext4/xattr.c-1541-				     EXT4_IGET_EA_INODE);
]

gemini-3.1-pro-preview

							input: 43063
							output: 42
							thoughts: 45
						

Here's my summary, as the thought process unfolds:

**Digging into ext4_nfs_get_inode**

Okay, so `ext4_nfs_get_inode` is using `EXT4_IGET_HANDLE`. That's the starting point. I need to understand how the inode is being retrieved and handled in this NFS context. It's time to drill down and see what's happening with that `EXT4_IGET_HANDLE`. My next step is to examine what the `check_igot_inode` function does with that `EXT4_IGET_HANDLE`. That function holds the key to understanding this inode retrieval path. I'll focus on how it's used and what conditions are being checked. I'm looking for the essential logic here, particularly regarding NFS and potential concurrency issues in inode management. Let's see...

map[ContextFile:fs/ext4/inode.c IncludeLines:true Name:check_igot_inode]

map[SourceCode:5139:	static int check_igot_inode(struct inode *inode, ext4_iget_flags flags,
5140:				    const char *function, unsigned int line)
5141:	{
5142:		const char *err_str;
5143:	
5144:		if (flags & EXT4_IGET_EA_INODE) {
5145:			if (!(EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL)) {
5146:				err_str = "missing EA_INODE flag";
5147:				goto error;
5148:			}
5149:			if (ext4_test_inode_state(inode, EXT4_STATE_XATTR) ||
5150:			    EXT4_I(inode)->i_file_acl) {
5151:				err_str = "ea_inode with extended attributes";
5152:				goto error;
5153:			}
5154:		} else {
5155:			if ((EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL)) {
5156:				/*
5157:				 * open_by_handle_at() could provide an old inode number
5158:				 * that has since been reused for an ea_inode; this does
5159:				 * not indicate filesystem corruption
5160:				 */
5161:				if (flags & EXT4_IGET_HANDLE)
5162:					return -ESTALE;
5163:				err_str = "unexpected EA_INODE flag";
5164:				goto error;
5165:			}
5166:		}
5167:		if (is_bad_inode(inode) && !(flags & EXT4_IGET_BAD)) {
5168:			err_str = "unexpected bad inode w/o EXT4_IGET_BAD";
5169:			goto error;
5170:		}
5171:		return 0;
5172:	
5173:	error:
5174:		ext4_error_inode(inode, function, line, 0, "%s", err_str);
5175:		return -EFSCORRUPTED;
5176:	}
 SourceFile:fs/ext4/inode.c]

gemini-3.1-pro-preview

							input: 43961
							output: 47
							thoughts: 2206
						

**Analyzing the EA Inode Corruption Bug**

Okay, so I've been digging into this EXT4 EA inode issue. Initially, I thought that `open_by_handle_at` and `ext4_lookup` would be the primary culprits, since they explicitly handle the `EXT4_EA_INODE_FL` flag and have checks that would return errors if encountered under certain conditions. But the syzkaller reproducer triggered something else entirely, so it means something else is at play.

Looking at the reproducer, it's a sequence of `setxattr` on `./file0/file0`, `open` on `./file1`, `fallocate` on `./file1`, and `unlink` on `./file0/file0`. It seems the key here is the `setxattr` call creating an EA inode for `./file0/file0`. I need to figure out how this sequence leads to the reported corruption.

The lockdep report is what's giving me the most useful clues. The trace shows `setxattr` taking the `inode_lock` (subclass 0) of `./file0/file0` first. This makes sense: it's a normal file, so the lock is not subclass 3. Then, an EA inode is created (subclass 3) and `&ei->i_data_sem/3` is taken. So the dependency is `inode_lock (subclass 0) -> &ei->i_data_sem/3`.

The interesting part comes when the lockdep report shows an `ext4_truncate` call on an inode, but the process is already holding `&ei->i_data_sem/3`. Now, this is where it gets confusing, because if we are looking at `./file0/file0` then it should have subclass 0 for its `i_data_sem`, not 3. Where is that coming from?

The clue is that subclass 3 is only set in `ext4_xattr_inode_set_class`, which is ONLY called in `ext4_xattr_inode_create` and `ext4_xattr_inode_iget`. `ext4_xattr_inode_iget` is called when we get an EA inode from disk, but if `./file0/file0` is a normal file, how does it end up with subclass 3?

map[ContextFile:fs/ext4/xattr.c IncludeLines:true Name:ext4_xattr_inode_iget]

map[SourceCode: 420:	static int ext4_xattr_inode_iget(struct inode *parent, unsigned long ea_ino,
 421:					 u32 ea_inode_hash, struct inode **ea_inode)
 422:	{
 423:		struct inode *inode;
 424:		int err;
 425:	
 426:		/*
 427:		 * We have to check for this corruption early as otherwise
 428:		 * iget_locked() could wait indefinitely for the state of our
 429:		 * parent inode.
 430:		 */
 431:		if (parent->i_ino == ea_ino) {
 432:			ext4_error(parent->i_sb,
 433:				   "Parent and EA inode have the same ino %lu", ea_ino);
 434:			return -EFSCORRUPTED;
 435:		}
 436:	
 437:		inode = ext4_iget(parent->i_sb, ea_ino, EXT4_IGET_EA_INODE);
 438:		if (IS_ERR(inode)) {
 439:			err = PTR_ERR(inode);
 440:			ext4_error(parent->i_sb,
 441:				   "error while reading EA inode %lu err=%d", ea_ino,
 442:				   err);
 443:			return err;
 444:		}
 445:		ext4_xattr_inode_set_class(inode);
 446:	
 447:		/*
 448:		 * Check whether this is an old Lustre-style xattr inode. Lustre
 449:		 * implementation does not have hash validation, rather it has a
 450:		 * backpointer from ea_inode to the parent inode.
 451:		 */
 452:		if (ea_inode_hash != ext4_xattr_inode_get_hash(inode) &&
 453:		    EXT4_XATTR_INODE_GET_PARENT(inode) == parent->i_ino &&
 454:		    inode->i_generation == parent->i_generation) {
 455:			ext4_set_inode_state(inode, EXT4_STATE_LUSTRE_EA_INODE);
 456:			ext4_xattr_inode_set_ref(inode, 1);
 457:		} else {
 458:			inode_lock_nested(inode, I_MUTEX_XATTR);
 459:			inode->i_flags |= S_NOQUOTA;
 460:			inode_unlock(inode);
 461:		}
 462:	
 463:		*ea_inode = inode;
 464:		return 0;
 465:	}
 SourceFile:fs/ext4/xattr.c]

gemini-3.1-pro-preview

							input: 47495
							output: 42
							thoughts: 131
						

**Analyzing the ext4 Extended Attribute Inode Handling**

Okay, so `ext4_xattr_inode_set_class(inode)` is triggered within `ext4_xattr_inode_iget`. That tells me that whenever an inode is retrieved specifically as an Extended Attribute (EA) inode, its lock classes get reconfigured to subclass 1 and 3. My brain's buzzing, though. What if that *same* inode had been fetched *before*, but as a regular, non-EA inode?

Hold on... if it was already in play as a normal inode, it'd already be residing in the inode cache. That also means that when `ext4_iget(..., EXT4_IGET_EA_INODE)` is later called, it should hit that cached inode! It wouldn't need to go to disk and retrieve a new one. I need to verify that. Let's dig into the `ext4_iget` function and make sure this caching logic behaves as I expect.

map[ContextFile:fs/ext4/inode.c IncludeLines:true Name:__ext4_iget]

map[SourceCode:5211:	struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
5212:				  ext4_iget_flags flags, const char *function,
5213:				  unsigned int line)
5214:	{
5215:		struct ext4_iloc iloc;
5216:		struct ext4_inode *raw_inode;
5217:		struct ext4_inode_info *ei;
5218:		struct ext4_super_block *es = EXT4_SB(sb)->s_es;
5219:		struct inode *inode;
5220:		journal_t *journal = EXT4_SB(sb)->s_journal;
5221:		long ret;
5222:		loff_t size;
5223:		int block;
5224:		uid_t i_uid;
5225:		gid_t i_gid;
5226:		projid_t i_projid;
5227:	
5228:		if ((!(flags & EXT4_IGET_SPECIAL) && is_special_ino(sb, ino)) ||
5229:		    (ino < EXT4_ROOT_INO) ||
5230:		    (ino > le32_to_cpu(es->s_inodes_count))) {
5231:			if (flags & EXT4_IGET_HANDLE)
5232:				return ERR_PTR(-ESTALE);
5233:			__ext4_error(sb, function, line, false, EFSCORRUPTED, 0,
5234:				     "inode #%lu: comm %s: iget: illegal inode #",
5235:				     ino, current->comm);
5236:			return ERR_PTR(-EFSCORRUPTED);
5237:		}
5238:	
5239:		inode = iget_locked(sb, ino);
5240:		if (!inode)
5241:			return ERR_PTR(-ENOMEM);
5242:		if (!(inode->i_state & I_NEW)) {
5243:			ret = check_igot_inode(inode, flags, function, line);
5244:			if (ret) {
5245:				iput(inode);
5246:				return ERR_PTR(ret);
5247:			}
5248:			return inode;
5249:		}
5250:	
5251:		ei = EXT4_I(inode);
5252:		iloc.bh = NULL;
5253:	
5254:		ret = __ext4_get_inode_loc_noinmem(inode, &iloc);
5255:		if (ret < 0)
5256:			goto bad_inode;
5257:		raw_inode = ext4_raw_inode(&iloc);
5258:	
5259:		if ((flags & EXT4_IGET_HANDLE) &&
5260:		    (raw_inode->i_links_count == 0) && (raw_inode->i_mode == 0)) {
5261:			ret = -ESTALE;
5262:			goto bad_inode;
5263:		}
5264:	
5265:		if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE) {
5266:			ei->i_extra_isize = le16_to_cpu(raw_inode->i_extra_isize);
5267:			if (EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize >
5268:				EXT4_INODE_SIZE(inode->i_sb) ||
5269:			    (ei->i_extra_isize & 3)) {
5270:				ext4_error_inode(inode, function, line, 0,
5271:						 "iget: bad extra_isize %u "
5272:						 "(inode size %u)",
5273:						 ei->i_extra_isize,
5274:						 EXT4_INODE_SIZE(inode->i_sb));
5275:				ret = -EFSCORRUPTED;
5276:				goto bad_inode;
5277:			}
5278:		} else
5279:			ei->i_extra_isize = 0;
5280:	
5281:		/* Precompute checksum seed for inode metadata */
5282:		if (ext4_has_feature_metadata_csum(sb)) {
5283:			struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
5284:			__u32 csum;
5285:			__le32 inum = cpu_to_le32(inode->i_ino);
5286:			__le32 gen = raw_inode->i_generation;
5287:			csum = ext4_chksum(sbi->s_csum_seed, (__u8 *)&inum,
5288:					   sizeof(inum));
5289:			ei->i_csum_seed = ext4_chksum(csum, (__u8 *)&gen, sizeof(gen));
5290:		}
5291:	
5292:		if ((!ext4_inode_csum_verify(inode, raw_inode, ei) ||
5293:		    ext4_simulate_fail(sb, EXT4_SIM_INODE_CRC)) &&
5294:		     (!(EXT4_SB(sb)->s_mount_state & EXT4_FC_REPLAY))) {
5295:			ext4_error_inode_err(inode, function, line, 0,
5296:					EFSBADCRC, "iget: checksum invalid");
5297:			ret = -EFSBADCRC;
5298:			goto bad_inode;
5299:		}
5300:	
5301:		inode->i_mode = le16_to_cpu(raw_inode->i_mode);
5302:		i_uid = (uid_t)le16_to_cpu(raw_inode->i_uid_low);
5303:		i_gid = (gid_t)le16_to_cpu(raw_inode->i_gid_low);
5304:		if (ext4_has_feature_project(sb) &&
5305:		    EXT4_INODE_SIZE(sb) > EXT4_GOOD_OLD_INODE_SIZE &&
5306:		    EXT4_FITS_IN_INODE(raw_inode, ei, i_projid))
5307:			i_projid = (projid_t)le32_to_cpu(raw_inode->i_projid);
5308:		else
5309:			i_projid = EXT4_DEF_PROJID;
5310:	
5311:		if (!(test_opt(inode->i_sb, NO_UID32))) {
5312:			i_uid |= le16_to_cpu(raw_inode->i_uid_high) << 16;
5313:			i_gid |= le16_to_cpu(raw_inode->i_gid_high) << 16;
5314:		}
5315:		i_uid_write(inode, i_uid);
5316:		i_gid_write(inode, i_gid);
5317:		ei->i_projid = make_kprojid(&init_user_ns, i_projid);
5318:		set_nlink(inode, le16_to_cpu(raw_inode->i_links_count));
5319:	
5320:		ext4_clear_state_flags(ei);	/* Only relevant on 32-bit archs */
5321:		ei->i_inline_off = 0;
5322:		ei->i_dir_start_lookup = 0;
5323:		ei->i_dtime = le32_to_cpu(raw_inode->i_dtime);
5324:		/* We now have enough fields to check if the inode was active or not.
5325:		 * This is needed because nfsd might try to access dead inodes
5326:		 * the test is that same one that e2fsck uses
5327:		 * NeilBrown 1999oct15
5328:		 */
5329:		if (inode->i_nlink == 0) {
5330:			if ((inode->i_mode == 0 || flags & EXT4_IGET_SPECIAL ||
5331:			     !(EXT4_SB(inode->i_sb)->s_mount_state & EXT4_ORPHAN_FS)) &&
5332:			    ino != EXT4_BOOT_LOADER_INO) {
5333:				/* this inode is deleted or unallocated */
5334:				if (flags & EXT4_IGET_SPECIAL) {
5335:					ext4_error_inode(inode, function, line, 0,
5336:							 "iget: special inode unallocated");
5337:					ret = -EFSCORRUPTED;
5338:				} else
5339:					ret = -ESTALE;
5340:				goto bad_inode;
5341:			}
5342:			/* The only unlinked inodes we let through here have
5343:			 * valid i_mode and are being read by the orphan
5344:			 * recovery code: that's fine, we're about to complete
5345:			 * the process of deleting those.
5346:			 * OR it is the EXT4_BOOT_LOADER_INO which is
5347:			 * not initialized on a new filesystem. */
5348:		}
5349:		ei->i_flags = le32_to_cpu(raw_inode->i_flags);
5350:		ext4_set_inode_flags(inode, true);
5351:		inode->i_blocks = ext4_inode_blocks(raw_inode, ei);
5352:		ei->i_file_acl = le32_to_cpu(raw_inode->i_file_acl_lo);
5353:		if (ext4_has_feature_64bit(sb))
5354:			ei->i_file_acl |=
5355:				((__u64)le16_to_cpu(raw_inode->i_file_acl_high)) << 32;
5356:		inode->i_size = ext4_isize(sb, raw_inode);
5357:		size = i_size_read(inode);
5358:		if (size < 0 || size > ext4_get_maxbytes(inode)) {
5359:			ext4_error_inode(inode, function, line, 0,
5360:					 "iget: bad i_size value: %lld", size);
5361:			ret = -EFSCORRUPTED;
5362:			goto bad_inode;
5363:		}
5364:		/*
5365:		 * If dir_index is not enabled but there's dir with INDEX flag set,
5366:		 * we'd normally treat htree data as empty space. But with metadata
5367:		 * checksumming that corrupts checksums so forbid that.
5368:		 */
5369:		if (!ext4_has_feature_dir_index(sb) &&
5370:		    ext4_has_feature_metadata_csum(sb) &&
5371:		    ext4_test_inode_flag(inode, EXT4_INODE_INDEX)) {
5372:			ext4_error_inode(inode, function, line, 0,
5373:				 "iget: Dir with htree data on filesystem without dir_index feature.");
5374:			ret = -EFSCORRUPTED;
5375:			goto bad_inode;
5376:		}
5377:		ei->i_disksize = inode->i_size;
5378:	#ifdef CONFIG_QUOTA
5379:		ei->i_reserved_quota = 0;
5380:	#endif
5381:		inode->i_generation = le32_to_cpu(raw_inode->i_generation);
5382:		ei->i_block_group = iloc.block_group;
5383:		ei->i_last_alloc_group = ~0;
5384:		/*
5385:		 * NOTE! The in-memory inode i_data array is in little-endian order
5386:		 * even on big-endian machines: we do NOT byteswap the block numbers!
5387:		 */
5388:		for (block = 0; block < EXT4_N_BLOCKS; block++)
5389:			ei->i_data[block] = raw_inode->i_block[block];
5390:		INIT_LIST_HEAD(&ei->i_orphan);
5391:		ext4_fc_init_inode(&ei->vfs_inode);
5392:	
5393:		/*
5394:		 * Set transaction id's of transactions that have to be committed
5395:		 * to finish f[data]sync. We set them to currently running transaction
5396:		 * as we cannot be sure that the inode or some of its metadata isn't
5397:		 * part of the transaction - the inode could have been reclaimed and
5398:		 * now it is reread from disk.
5399:		 */
5400:		if (journal) {
5401:			transaction_t *transaction;
5402:			tid_t tid;
5403:	
5404:			read_lock(&journal->j_state_lock);
5405:			if (journal->j_running_transaction)
5406:				transaction = journal->j_running_transaction;
5407:			else
5408:				transaction = journal->j_committing_transaction;
5409:			if (transaction)
5410:				tid = transaction->t_tid;
5411:			else
5412:				tid = journal->j_commit_sequence;
5413:			read_unlock(&journal->j_state_lock);
5414:			ei->i_sync_tid = tid;
5415:			ei->i_datasync_tid = tid;
5416:		}
5417:	
5418:		if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE) {
5419:			if (ei->i_extra_isize == 0) {
5420:				/* The extra space is currently unused. Use it. */
5421:				BUILD_BUG_ON(sizeof(struct ext4_inode) & 3);
5422:				ei->i_extra_isize = sizeof(struct ext4_inode) -
5423:						    EXT4_GOOD_OLD_INODE_SIZE;
5424:			} else {
5425:				ret = ext4_iget_extra_inode(inode, raw_inode, ei);
5426:				if (ret)
5427:					goto bad_inode;
5428:			}
5429:		}
5430:	
5431:		EXT4_INODE_GET_CTIME(inode, raw_inode);
5432:		EXT4_INODE_GET_ATIME(inode, raw_inode);
5433:		EXT4_INODE_GET_MTIME(inode, raw_inode);
5434:		EXT4_EINODE_GET_XTIME(i_crtime, ei, raw_inode);
5435:	
5436:		if (likely(!test_opt2(inode->i_sb, HURD_COMPAT))) {
5437:			u64 ivers = le32_to_cpu(raw_inode->i_disk_version);
5438:	
5439:			if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE) {
5440:				if (EXT4_FITS_IN_INODE(raw_inode, ei, i_version_hi))
5441:					ivers |=
5442:			    (__u64)(le32_to_cpu(raw_inode->i_version_hi)) << 32;
5443:			}
5444:			ext4_inode_set_iversion_queried(inode, ivers);
5445:		}
5446:	
5447:		ret = 0;
5448:		if (ei->i_file_acl &&
5449:		    !ext4_inode_block_valid(inode, ei->i_file_acl, 1)) {
5450:			ext4_error_inode(inode, function, line, 0,
5451:					 "iget: bad extended attribute block %llu",
5452:					 ei->i_file_acl);
5453:			ret = -EFSCORRUPTED;
5454:			goto bad_inode;
5455:		} else if (!ext4_has_inline_data(inode)) {
5456:			/* validate the block references in the inode */
5457:			if (!(EXT4_SB(sb)->s_mount_state & EXT4_FC_REPLAY) &&
5458:				(S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode) ||
5459:				(S_ISLNK(inode->i_mode) &&
5460:				!ext4_inode_is_fast_symlink(inode)))) {
5461:				if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))
5462:					ret = ext4_ext_check_inode(inode);
5463:				else
5464:					ret = ext4_ind_check_inode(inode);
5465:			}
5466:		}
5467:		if (ret)
5468:			goto bad_inode;
5469:	
5470:		if (S_ISREG(inode->i_mode)) {
5471:			inode->i_op = &ext4_file_inode_operations;
5472:			inode->i_fop = &ext4_file_operations;
5473:			ext4_set_aops(inode);
5474:		} else if (S_ISDIR(inode->i_mode)) {
5475:			inode->i_op = &ext4_dir_inode_operations;
5476:			inode->i_fop = &ext4_dir_operations;
5477:		} else if (S_ISLNK(inode->i_mode)) {
5478:			/* VFS does not allow setting these so must be corruption */
5479:			if (IS_APPEND(inode) || IS_IMMUTABLE(inode)) {
5480:				ext4_error_inode(inode, function, line, 0,
5481:						 "iget: immutable or append flags "
5482:						 "not allowed on symlinks");
5483:				ret = -EFSCORRUPTED;
5484:				goto bad_inode;
5485:			}
5486:			if (IS_ENCRYPTED(inode)) {
5487:				inode->i_op = &ext4_encrypted_symlink_inode_operations;
5488:			} else if (ext4_inode_is_fast_symlink(inode)) {
5489:				inode->i_op = &ext4_fast_symlink_inode_operations;
5490:				if (inode->i_size == 0 ||
5491:				    inode->i_size >= sizeof(ei->i_data) ||
5492:				    strnlen((char *)ei->i_data, inode->i_size + 1) !=
5493:									inode->i_size) {
5494:					ext4_error_inode(inode, function, line, 0,
5495:						"invalid fast symlink length %llu",
5496:						 (unsigned long long)inode->i_size);
5497:					ret = -EFSCORRUPTED;
5498:					goto bad_inode;
5499:				}
5500:				inode_set_cached_link(inode, (char *)ei->i_data,
5501:						      inode->i_size);
5502:			} else {
5503:				inode->i_op = &ext4_symlink_inode_operations;
5504:			}
5505:		} else if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode) ||
5506:		      S_ISFIFO(inode->i_mode) || S_ISSOCK(inode->i_mode)) {
5507:			inode->i_op = &ext4_special_inode_operations;
5508:			if (raw_inode->i_block[0])
5509:				init_special_inode(inode, inode->i_mode,
5510:				   old_decode_dev(le32_to_cpu(raw_inode->i_block[0])));
5511:			else
5512:				init_special_inode(inode, inode->i_mode,
5513:				   new_decode_dev(le32_to_cpu(raw_inode->i_block[1])));
5514:		} else if (ino == EXT4_BOOT_LOADER_INO) {
5515:			make_bad_inode(inode);
5516:		} else {
5517:			ret = -EFSCORRUPTED;
5518:			ext4_error_inode(inode, function, line, 0,
5519:					 "iget: bogus i_mode (%o)", inode->i_mode);
5520:			goto bad_inode;
5521:		}
5522:		if (IS_CASEFOLDED(inode) && !ext4_has_feature_casefold(inode->i_sb)) {
5523:			ext4_error_inode(inode, function, line, 0,
5524:					 "casefold flag without casefold feature");
5525:			ret = -EFSCORRUPTED;
5526:			goto bad_inode;
5527:		}
5528:	
5529:		ext4_set_inode_mapping_order(inode);
5530:	
5531:		ret = check_igot_inode(inode, flags, function, line);
5532:		/*
5533:		 * -ESTALE here means there is nothing inherently wrong with the inode,
5534:		 * it's just not an inode we can return for an fhandle lookup.
5535:		 */
5536:		if (ret == -ESTALE) {
5537:			brelse(iloc.bh);
5538:			unlock_new_inode(inode);
5539:			iput(inode);
5540:			return ERR_PTR(-ESTALE);
5541:		}
5542:		if (ret)
5543:			goto bad_inode;
5544:		brelse(iloc.bh);
5545:	
5546:		unlock_new_inode(inode);
5547:		return inode;
5548:	
5549:	bad_inode:
5550:		brelse(iloc.bh);
5551:		iget_failed(inode);
5552:		return ERR_PTR(ret);
5553:	}
 SourceFile:fs/ext4/inode.c]

gemini-3.1-pro-preview

							input: 54158
							output: 20
							thoughts: 2986
						

**Analyzing the Ext4 Lockdep Warning in Xattr Operations**

Okay, so `check_igot_inode` is a crucial function, called for both cached and newly read inodes. I'm focusing on its behavior with `EXT4_EA_INODE_FL`, the extended attribute (EA) inode flag. It seems that when an inode is already in the cache, it's subjected to an additional check via `check_igot_inode`. If an EA inode is fetched as a normal file or vice versa, `check_igot_inode` raises `-EFSCORRUPTED`. This means that an inode *cannot* exist as both a regular file and an EA inode simultaneously within the Ext4 file system.

Now, how does the reproducer trigger the lockdep warning? The reproducer calls `setxattr` on a normal file ("./file0/file0") to set an xattr. This operation creates an EA inode in the background. The lock dependency it establishes is straightforward: `inode_lock` (subclass 0 - for the normal file) -> `i_data_sem` (subclass 3 - for the EA inode). The lockdep report shows `&sb->s_type->i_mutex_key#9/1`, however, indicating that subclass 1 is involved.

Tracing the code, `ext4_xattr_inode_create` takes `inode_lock(ea_inode)` (subclass 1), confirming my suspicion. `ext4_truncate` on an EA inode calls `ext4_xattr_inode_create`. Thus `ext4_truncate` on an EA inode creates the dependency: `&ei->i_data_sem/3` -> `&sb->s_type->i_mutex_key#9/1`. However, I can't find a path that holds `inode_lock(ea_inode)` when calling `ext4_xattr_inode_create`.

The reverse dependency is also essential here. The lockdep report shows `vfs_setxattr` taking the lock, before calling functions that take `&ei->i_data_sem`. `vfs_setxattr` calls `inode_lock` of the file (potentially the EA inode). This creates a dependency: `&sb->s_type->i_mutex_key#9/1` -> `&ei->i_data_sem/3`. However, the root inode can be an EA inode if it does not use `EXT4_IGET_EA_INODE`.

The puzzle then is why the lockdep report displays `/1`. This means lockdep thinks that `vfs_setxattr` is holding a lock with subclass 1. This would mean that, for directories, `inode_lock` is subclass `I_MUTEX_PARENT`, which is 1. This means the file must have been a directory, when it should be a file. I will check the `I_MUTEX_PARENT` values.

map[Expression:I_MUTEX_PARENT]

map[Output:arch/powerpc/platforms/cell/spufs/inode.c=192=static int spufs_dir_close(struct inode *inode, struct file *file)
--
arch/powerpc/platforms/cell/spufs/inode.c-199-
arch/powerpc/platforms/cell/spufs/inode.c:200:	inode_lock_nested(parent, I_MUTEX_PARENT);
arch/powerpc/platforms/cell/spufs/inode.c-201-	spufs_rmdir(parent, dir);
--
fs/binfmt_misc.c=718=static ssize_t bm_entry_write(struct file *file, const char __user *buffer,
--
fs/binfmt_misc.c-736-		inode = d_inode(inode->i_sb->s_root);
fs/binfmt_misc.c:737:		inode_lock_nested(inode, I_MUTEX_PARENT);
fs/binfmt_misc.c-738-
--
fs/binfmt_misc.c=866=static ssize_t bm_status_write(struct file *file, const char __user *buffer,
--
fs/binfmt_misc.c-886-		inode = d_inode(file_inode(file)->i_sb->s_root);
fs/binfmt_misc.c:887:		inode_lock_nested(inode, I_MUTEX_PARENT);
fs/binfmt_misc.c-888-
--
fs/btrfs/ioctl.c=895=static noinline int btrfs_mksubvol(struct dentry *parent,
--
fs/btrfs/ioctl.c-906-
fs/btrfs/ioctl.c:907:	ret = down_write_killable_nested(&dir->i_rwsem, I_MUTEX_PARENT);
fs/btrfs/ioctl.c-908-	if (ret == -EINTR)
--
fs/btrfs/ioctl.c=2272=static noinline int btrfs_ioctl_snap_destroy(struct file *file,
--
fs/btrfs/ioctl.c-2419-
fs/btrfs/ioctl.c:2420:	ret = down_write_killable_nested(&dir->i_rwsem, I_MUTEX_PARENT);
fs/btrfs/ioctl.c-2421-	if (ret == -EINTR)
--
fs/cachefiles/interface.c=391=static bool cachefiles_invalidate_cookie(struct fscache_cookie *cookie)
--
fs/cachefiles/interface.c-431-
fs/cachefiles/interface.c:432:			inode_lock_nested(d_inode(fan), I_MUTEX_PARENT);
fs/cachefiles/interface.c-433-			cachefiles_bury_object(volume->cache, object, fan,
--
fs/cachefiles/namei.c=84=struct dentry *cachefiles_get_directory(struct cachefiles_cache *cache,
--
fs/cachefiles/namei.c-95-	/* search the current directory for the element name */
fs/cachefiles/namei.c:96:	inode_lock_nested(d_inode(dir), I_MUTEX_PARENT);
fs/cachefiles/namei.c-97-
--
fs/cachefiles/namei.c=419=int cachefiles_delete_object(struct cachefiles_object *object,
--
fs/cachefiles/namei.c-431-
fs/cachefiles/namei.c:432:	inode_lock_nested(d_backing_inode(fan), I_MUTEX_PARENT);
fs/cachefiles/namei.c-433-	ret = cachefiles_unlink(volume->cache, object, fan, dentry, why);
--
fs/cachefiles/namei.c=622=bool cachefiles_look_up_object(struct cachefiles_object *object)
--
fs/cachefiles/namei.c-647-		pr_err("%pd is not a file\n", dentry);
fs/cachefiles/namei.c:648:		inode_lock_nested(d_inode(fan), I_MUTEX_PARENT);
fs/cachefiles/namei.c-649-		ret = cachefiles_bury_object(volume->cache, object, fan, dentry,
--
fs/cachefiles/namei.c=673=bool cachefiles_commit_tmpfile(struct cachefiles_cache *cache,
--
fs/cachefiles/namei.c-682-
fs/cachefiles/namei.c:683:	inode_lock_nested(d_inode(fan), I_MUTEX_PARENT);
fs/cachefiles/namei.c-684-	ret = cachefiles_inject_read_error();
--
fs/cachefiles/namei.c=745=static struct dentry *cachefiles_lookup_for_cull(struct cachefiles_cache *cache,
--
fs/cachefiles/namei.c-751-
fs/cachefiles/namei.c:752:	inode_lock_nested(d_inode(dir), I_MUTEX_PARENT);
fs/cachefiles/namei.c-753-
--
fs/cachefiles/volume.c=17=void cachefiles_acquire_volume(struct fscache_volume *vcookie)
--
fs/cachefiles/volume.c-60-				goto error_dir;
fs/cachefiles/volume.c:61:			inode_lock_nested(d_inode(cache->store), I_MUTEX_PARENT);
fs/cachefiles/volume.c-62-			cachefiles_bury_object(cache, NULL, cache->store, vdentry,
--
fs/configfs/dir.c=1751=int configfs_register_group(struct config_group *parent_group,
--
fs/configfs/dir.c-1768-
fs/configfs/dir.c:1769:	inode_lock_nested(d_inode(parent), I_MUTEX_PARENT);
fs/configfs/dir.c-1770-	ret = create_default_group(parent_group, group, frag);
--
fs/configfs/dir.c=1796=void configfs_unregister_group(struct config_group *group)
--
fs/configfs/dir.c-1807-
fs/configfs/dir.c:1808:	inode_lock_nested(d_inode(parent), I_MUTEX_PARENT);
fs/configfs/dir.c-1809-	spin_lock(&configfs_dirent_lock);
--
fs/configfs/dir.c=1872=int configfs_register_subsystem(struct configfs_subsystem *subsys)
--
fs/configfs/dir.c-1898-
fs/configfs/dir.c:1899:	inode_lock_nested(d_inode(root), I_MUTEX_PARENT);
fs/configfs/dir.c-1900-
--
fs/configfs/dir.c=1935=void configfs_unregister_subsystem(struct configfs_subsystem *subsys)
--
fs/configfs/dir.c-1952-	inode_lock_nested(d_inode(root),
fs/configfs/dir.c:1953:			  I_MUTEX_PARENT);
fs/configfs/dir.c-1954-	inode_lock_nested(d_inode(dentry), I_MUTEX_CHILD);
--
fs/ecryptfs/inode.c=27=static int lock_parent(struct dentry *dentry,
--
fs/ecryptfs/inode.c-36-
fs/ecryptfs/inode.c:37:	inode_lock_nested(*lower_dir, I_MUTEX_PARENT);
fs/ecryptfs/inode.c-38-	return (*lower_dentry)->d_parent == lower_dir_dentry ? 0 : -EINVAL;
--
fs/fuse/dir.c=1394=int fuse_reverse_inval_entry(struct fuse_conn *fc, u64 parent_nodeid,
--
fs/fuse/dir.c-1405-
fs/fuse/dir.c:1406:	inode_lock_nested(parent, I_MUTEX_PARENT);
fs/fuse/dir.c-1407-	if (!S_ISDIR(parent->i_mode))
--
fs/libfs.c=656=EXPORT_SYMBOL(simple_recursive_removal);
fs/libfs.c-657-
fs/libfs.c:658:/* caller holds parent directory with I_MUTEX_PARENT */
fs/libfs.c-659-void locked_recursive_removal(struct dentry *dentry,
--
fs/namei.c=2747=static struct dentry *__kern_path_locked(int dfd, struct filename *name, struct path *path)
--
fs/namei.c-2758-		return ERR_PTR(-EINVAL);
fs/namei.c:2759:	inode_lock_nested(parent_path.dentry->d_inode, I_MUTEX_PARENT);
fs/namei.c-2760-	d = lookup_one_qstr_excl(&last, parent_path.dentry, 0);
--
fs/namei.c=2770=struct dentry *kern_path_locked_negative(const char *name, struct path *path)
--
fs/namei.c-2782-		return ERR_PTR(-EINVAL);
fs/namei.c:2783:	inode_lock_nested(parent_path.dentry->d_inode, I_MUTEX_PARENT);
fs/namei.c-2784-	d = lookup_one_qstr_excl(&last, parent_path.dentry, LOOKUP_CREATE);
--
fs/namei.c=3234=static struct dentry *lock_two_directories(struct dentry *p1, struct dentry *p2)
--
fs/namei.c-3241-		// p is a child of p2 and an ancestor of p1 or p1 itself
fs/namei.c:3242:		inode_lock_nested(p2->d_inode, I_MUTEX_PARENT);
fs/namei.c:3243:		inode_lock_nested(p1->d_inode, I_MUTEX_PARENT2);
fs/namei.c-3244-		return p;
--
fs/namei.c-3251-		// q is a child of p1 and an ancestor of p2 or p2 itself
fs/namei.c:3252:		inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
fs/namei.c:3253:		inode_lock_nested(p2->d_inode, I_MUTEX_PARENT2);
fs/namei.c-3254-		return q;
--
fs/namei.c-3256-		// both p2 and p1 are descendents of p
fs/namei.c:3257:		inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
fs/namei.c:3258:		inode_lock_nested(p2->d_inode, I_MUTEX_PARENT2);
fs/namei.c-3259-		return NULL;
--
fs/namei.c=3269=struct dentry *lock_rename(struct dentry *p1, struct dentry *p2)
--
fs/namei.c-3271-	if (p1 == p2) {
fs/namei.c:3272:		inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
fs/namei.c-3273-		return NULL;
--
fs/namei.c=3284=struct dentry *lock_rename_child(struct dentry *c1, struct dentry *p2)
--
fs/namei.c-3289-		 */
fs/namei.c:3290:		inode_lock_nested(p2->d_inode, I_MUTEX_PARENT);
fs/namei.c-3291-		/*
--
fs/namei.c-3316-	 */
fs/namei.c:3317:	inode_lock_nested(p2->d_inode, I_MUTEX_PARENT);
fs/namei.c-3318-	mutex_unlock(&c1->d_sb->s_vfs_rename_mutex);
--
fs/namei.c=4108=static struct dentry *filename_create(int dfd, struct filename *name,
--
fs/namei.c-4138-		create_flags &= ~LOOKUP_CREATE;
fs/namei.c:4139:	inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT);
fs/namei.c-4140-	dentry = lookup_one_qstr_excl(&last, path->dentry,
--
fs/namei.c=4479=int do_rmdir(int dfd, struct filename *name)
--
fs/namei.c-4507-
fs/namei.c:4508:	inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT);
fs/namei.c-4509-	dentry = lookup_one_qstr_excl(&last, path.dentry, lookup_flags);
--
fs/namei.c=4614=int do_unlinkat(int dfd, struct filename *name)
--
fs/namei.c-4636-retry_deleg:
fs/namei.c:4637:	inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT);
fs/namei.c-4638-	dentry = lookup_one_qstr_excl(&last, path.dentry, lookup_flags);
--
fs/nfsd/nfs3proc.c=253=nfsd3_create_file(struct svc_rqst *rqstp, struct svc_fh *fhp,
--
fs/nfsd/nfs3proc.c-283-
fs/nfsd/nfs3proc.c:284:	inode_lock_nested(inode, I_MUTEX_PARENT);
fs/nfsd/nfs3proc.c-285-
--
fs/nfsd/nfs4proc.c=235=nfsd4_create_file(struct svc_rqst *rqstp, struct svc_fh *fhp,
--
fs/nfsd/nfs4proc.c-266-
fs/nfsd/nfs4proc.c:267:	inode_lock_nested(inode, I_MUTEX_PARENT);
fs/nfsd/nfs4proc.c-268-
--
fs/nfsd/nfs4recover.c=293=nfsd4_list_rec_dir(recdir_func *f, struct nfsd_net *nn)
--
fs/nfsd/nfs4recover.c-314-	status = iterate_dir(nn->rec_file, &ctx.ctx);
fs/nfsd/nfs4recover.c:315:	inode_lock_nested(d_inode(dir), I_MUTEX_PARENT);
fs/nfsd/nfs4recover.c-316-
--
fs/nfsd/nfs4recover.c=344=nfsd4_unlink_clid_dir(char *name, struct nfsd_net *nn)
--
fs/nfsd/nfs4recover.c-351-	dir = nn->rec_file->f_path.dentry;
fs/nfsd/nfs4recover.c:352:	inode_lock_nested(d_inode(dir), I_MUTEX_PARENT);
fs/nfsd/nfs4recover.c-353-	dentry = lookup_one(&nop_mnt_idmap, &QSTR(name), dir);
--
fs/nfsd/nfsproc.c=277=nfsd_proc_create(struct svc_rqst *rqstp)
--
fs/nfsd/nfsproc.c-308-
fs/nfsd/nfsproc.c:309:	inode_lock_nested(dirfhp->fh_dentry->d_inode, I_MUTEX_PARENT);
fs/nfsd/nfsproc.c-310-	dchild = lookup_one(&nop_mnt_idmap, &QSTR_LEN(argp->name, argp->len),
--
fs/nfsd/vfs.c=1585=nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp,
--
fs/nfsd/vfs.c-1607-
fs/nfsd/vfs.c:1608:	inode_lock_nested(dentry->d_inode, I_MUTEX_PARENT);
fs/nfsd/vfs.c-1609-	dchild = lookup_one(&nop_mnt_idmap, &QSTR_LEN(fname, flen), dentry);
--
fs/nfsd/vfs.c=1686=nfsd_symlink(struct svc_rqst *rqstp, struct svc_fh *fhp,
--
fs/nfsd/vfs.c-1714-	dentry = fhp->fh_dentry;
fs/nfsd/vfs.c:1715:	inode_lock_nested(dentry->d_inode, I_MUTEX_PARENT);
fs/nfsd/vfs.c-1716-	dnew = lookup_one(&nop_mnt_idmap, &QSTR_LEN(fname, flen), dentry);
--
fs/nfsd/vfs.c=1756=nfsd_link(struct svc_rqst *rqstp, struct svc_fh *ffhp,
--
fs/nfsd/vfs.c-1790-	dirp = d_inode(ddir);
fs/nfsd/vfs.c:1791:	inode_lock_nested(dirp, I_MUTEX_PARENT);
fs/nfsd/vfs.c-1792-
--
fs/nfsd/vfs.c=2032=nfsd_unlink(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
--
fs/nfsd/vfs.c-2055-	dirp = d_inode(dentry);
fs/nfsd/vfs.c:2056:	inode_lock_nested(dirp, I_MUTEX_PARENT);
fs/nfsd/vfs.c-2057-
--
fs/overlayfs/copy_up.c=597=static int ovl_link_up(struct ovl_copy_up_ctx *c)
--
fs/overlayfs/copy_up.c-615-
fs/overlayfs/copy_up.c:616:	inode_lock_nested(udir, I_MUTEX_PARENT);
fs/overlayfs/copy_up.c-617-	upper = ovl_lookup_upper(ofs, c->dentry->d_name.name, upperdir,
--
fs/overlayfs/copy_up.c=863=static int ovl_copy_up_tmpfile(struct ovl_copy_up_ctx *c)
--
fs/overlayfs/copy_up.c-896-
fs/overlayfs/copy_up.c:897:	inode_lock_nested(udir, I_MUTEX_PARENT);
fs/overlayfs/copy_up.c-898-
--
fs/overlayfs/dir.c=81=static struct dentry *ovl_whiteout(struct ovl_fs *ofs)
--
fs/overlayfs/dir.c-90-	if (!ofs->whiteout) {
fs/overlayfs/dir.c:91:		inode_lock_nested(wdir, I_MUTEX_PARENT);
fs/overlayfs/dir.c-92-		whiteout = ovl_lookup_temp(ofs, workdir);
--
fs/overlayfs/dir.c-106-	if (!ofs->no_shared_whiteout) {
fs/overlayfs/dir.c:107:		inode_lock_nested(wdir, I_MUTEX_PARENT);
fs/overlayfs/dir.c-108-		whiteout = ovl_lookup_temp(ofs, workdir);
--
fs/overlayfs/dir.c=224=struct dentry *ovl_create_temp(struct ovl_fs *ofs, struct dentry *workdir,
--
fs/overlayfs/dir.c-227-	struct dentry *ret;
fs/overlayfs/dir.c:228:	inode_lock_nested(workdir->d_inode, I_MUTEX_PARENT);
fs/overlayfs/dir.c-229-	ret = ovl_create_real(ofs, workdir,
--
fs/overlayfs/dir.c=325=static int ovl_create_upper(struct dentry *dentry, struct inode *inode,
--
fs/overlayfs/dir.c-333-
fs/overlayfs/dir.c:334:	inode_lock_nested(udir, I_MUTEX_PARENT);
fs/overlayfs/dir.c-335-	newdentry = ovl_create_real(ofs, upperdir,
--
fs/overlayfs/dir.c=809=static int ovl_remove_upper(struct dentry *dentry, bool is_dir,
--
fs/overlayfs/dir.c-825-
fs/overlayfs/dir.c:826:	inode_lock_nested(dir, I_MUTEX_PARENT);
fs/overlayfs/dir.c-827-	upper = ovl_lookup_upper(ofs, dentry->d_name.name, upperdir,
--
fs/overlayfs/export.c=358=static struct dentry *ovl_lookup_real_one(struct dentry *connected,
--
fs/overlayfs/export.c-373-	 */
fs/overlayfs/export.c:374:	inode_lock_nested(dir, I_MUTEX_PARENT);
fs/overlayfs/export.c-375-	err = -ECHILD;
--
fs/overlayfs/super.c=293=static struct dentry *ovl_workdir_create(struct ovl_fs *ofs,
--
fs/overlayfs/super.c-302-retry:
fs/overlayfs/super.c:303:	inode_lock_nested(dir, I_MUTEX_PARENT);
fs/overlayfs/super.c-304-	work = ovl_lookup_upper(ofs, name, ofs->workbasedir, strlen(name));
--
fs/overlayfs/super.c=615=static struct dentry *ovl_lookup_or_create(struct ovl_fs *ofs,
--
fs/overlayfs/super.c-621-
fs/overlayfs/super.c:622:	inode_lock_nested(parent->d_inode, I_MUTEX_PARENT);
fs/overlayfs/super.c-623-	child = ovl_lookup_upper(ofs, name, parent, len);
--
fs/overlayfs/util.c=1552=int ovl_parent_lock(struct dentry *parent, struct dentry *child)
fs/overlayfs/util.c-1553-{
fs/overlayfs/util.c:1554:	inode_lock_nested(parent->d_inode, I_MUTEX_PARENT);
fs/overlayfs/util.c-1555-	if (!child ||
--
fs/pstore/inode.c=290=static struct dentry *psinfo_lock_root(void)
--
fs/pstore/inode.c-302-	root = pstore_sb->s_root;
fs/pstore/inode.c:303:	inode_lock_nested(d_inode(root), I_MUTEX_PARENT);
fs/pstore/inode.c-304-
--
fs/smb/server/vfs.c=58=int ksmbd_vfs_lock_parent(struct dentry *parent, struct dentry *child)
fs/smb/server/vfs.c-59-{
fs/smb/server/vfs.c:60:	inode_lock_nested(d_inode(parent), I_MUTEX_PARENT);
fs/smb/server/vfs.c-61-	if (child->d_parent != parent) {
--
fs/smb/server/vfs.c=69=static int ksmbd_vfs_path_lookup(struct ksmbd_share_config *share_conf,
--
fs/smb/server/vfs.c-107-
fs/smb/server/vfs.c:108:		inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT);
fs/smb/server/vfs.c-109-		d = lookup_one_qstr_excl(&last, path->dentry, 0);
--
fs/tracefs/inode.c=147=static int tracefs_syscall_rmdir(struct inode *inode, struct dentry *dentry)
--
fs/tracefs/inode.c-167-
fs/tracefs/inode.c:168:	inode_lock_nested(inode, I_MUTEX_PARENT);
fs/tracefs/inode.c-169-	inode_lock(d_inode(dentry));
--
fs/xfs/scrub/orphanage.c=122=xrep_orphanage_create(
--
fs/xfs/scrub/orphanage.c-154-	/* Try to find the orphanage directory. */
fs/xfs/scrub/orphanage.c:155:	inode_lock_nested(root_inode, I_MUTEX_PARENT);
fs/xfs/scrub/orphanage.c-156-	orphanage_dentry = lookup_noperm(&QSTR(ORPHANAGE), root_dentry);
--
include/linux/fs.h=857=enum inode_i_mutex_lock_class
--
include/linux/fs.h-859-	I_MUTEX_NORMAL,
include/linux/fs.h:860:	I_MUTEX_PARENT,
include/linux/fs.h-861-	I_MUTEX_CHILD,
--
include/linux/fs.h-863-	I_MUTEX_NONDIR2,
include/linux/fs.h:864:	I_MUTEX_PARENT2,
include/linux/fs.h-865-};
--
ipc/mqueue.c=955=SYSCALL_DEFINE1(mq_unlink, const char __user *, u_name)
--
ipc/mqueue.c-971-		goto out_name;
ipc/mqueue.c:972:	inode_lock_nested(d_inode(mnt->mnt_root), I_MUTEX_PARENT);
ipc/mqueue.c-973-	dentry = lookup_noperm(&QSTR(name->name), mnt->mnt_root);
--
security/apparmor/apparmorfs.c=1806=static struct dentry *ns_mkdir_op(struct mnt_idmap *idmap, struct inode *dir,
--
security/apparmor/apparmorfs.c-1829-	mutex_lock_nested(&parent->lock, parent->level);
security/apparmor/apparmorfs.c:1830:	inode_lock_nested(dir, I_MUTEX_PARENT);
security/apparmor/apparmorfs.c-1831-	if (error)
--
security/apparmor/apparmorfs.c=1857=static int ns_rmdir_op(struct inode *dir, struct dentry *dentry)
--
security/apparmor/apparmorfs.c-1892-	mutex_unlock(&parent->lock);
security/apparmor/apparmorfs.c:1893:	inode_lock_nested(dir, I_MUTEX_PARENT);
security/apparmor/apparmorfs.c-1894-	inode_lock(dentry->d_inode);
]

gemini-3.1-pro-preview

							input: 65029
							output: 39
							thoughts: 187
						

**Analyzing the Potential for Deadlock in `vfs_setxattr`**

Okay, so `I_MUTEX_PARENT` is indeed set to 1. That means we're dealing with parent mutexing, which could influence locking behavior. Now, if `vfs_setxattr` is called on a directory, it should take the `inode_lock` of the directory. Let me just confirm... yes, `vfs_setxattr` *does* take `inode_lock(inode)`. My immediate thought is, if `inode` is a directory, does this mean it will take subclass 1? But no, that's not right. `inode_lock` defaults to subclass 0, right?

Hang on... Let me check the definition. It's just a wrapper:

```c
static inline void inode_lock(struct inode *inode)
{
	down_write(&inode->i_rwsem);
}
```

Okay, so it takes whatever subclass `i_rwsem` was initialized with, or 0 if no specific subclass was given. The crucial question then becomes: Are directories' `i_rwsem` initialized with a different lock class? I'd better confirm this by checking `inode_init_always`. That's where I need to look to see how the semaphore is set up.

map[ContextFile:fs/inode.c IncludeLines:true Name:inode_init_always]

map[SourceCode:3306:	static inline int inode_init_always(struct super_block *sb, struct inode *inode)
3307:	{
3308:		return inode_init_always_gfp(sb, inode, GFP_NOFS);
3309:	}
 SourceFile:include/linux/fs.h]

gemini-3.1-pro-preview

							input: 65645
							output: 42
							thoughts: 14
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Diving into inode_init_always_gfp**

Okay, let's take a look at `inode_init_always_gfp`. I know this function is critical for inode initialization, particularly when we're dealing with memory allocation flags. I need to refresh my understanding of how it interacts with the `gfp_t` flag passed to it. I'm wondering if it ensures the inode's data structures are properly initialized regardless of allocation strategy, right down to the fundamental locking primitives. I need to see how it handles different allocation contexts, what the implications are for performance in various scenarios, and if there are any potential race conditions I should be on the lookout for, particularly in highly concurrent workloads. I'm also curious if any recent commits have modified this area and if so, how those changes might have impacted the existing memory allocation model. This function is a foundation, so a solid understanding here is key.

map[ContextFile:fs/inode.c IncludeLines:true Name:inode_init_always_gfp]

map[SourceCode: 217:	/**
 218:	 * inode_init_always_gfp - perform inode structure initialisation
 219:	 * @sb: superblock inode belongs to
 220:	 * @inode: inode to initialise
 221:	 * @gfp: allocation flags
 222:	 *
 223:	 * These are initializations that need to be done on every inode
 224:	 * allocation as the fields are not initialised by slab allocation.
 225:	 * If there are additional allocations required @gfp is used.
 226:	 */
 227:	int inode_init_always_gfp(struct super_block *sb, struct inode *inode, gfp_t gfp)
 228:	{
 229:		static const struct inode_operations empty_iops;
 230:		static const struct file_operations no_open_fops = {.open = no_open};
 231:		struct address_space *const mapping = &inode->i_data;
 232:	
 233:		inode->i_sb = sb;
 234:		inode->i_blkbits = sb->s_blocksize_bits;
 235:		inode->i_flags = 0;
 236:		inode->i_state = 0;
 237:		atomic64_set(&inode->i_sequence, 0);
 238:		atomic_set(&inode->i_count, 1);
 239:		inode->i_op = &empty_iops;
 240:		inode->i_fop = &no_open_fops;
 241:		inode->i_ino = 0;
 242:		inode->__i_nlink = 1;
 243:		inode->i_opflags = 0;
 244:		if (sb->s_xattr)
 245:			inode->i_opflags |= IOP_XATTR;
 246:		if (sb->s_type->fs_flags & FS_MGTIME)
 247:			inode->i_opflags |= IOP_MGTIME;
 248:		i_uid_write(inode, 0);
 249:		i_gid_write(inode, 0);
 250:		atomic_set(&inode->i_writecount, 0);
 251:		inode->i_size = 0;
 252:		inode->i_write_hint = WRITE_LIFE_NOT_SET;
 253:		inode->i_blocks = 0;
 254:		inode->i_bytes = 0;
 255:		inode->i_generation = 0;
 256:		inode->i_pipe = NULL;
 257:		inode->i_cdev = NULL;
 258:		inode->i_link = NULL;
 259:		inode->i_dir_seq = 0;
 260:		inode->i_rdev = 0;
 261:		inode->dirtied_when = 0;
 262:	
 263:	#ifdef CONFIG_CGROUP_WRITEBACK
 264:		inode->i_wb_frn_winner = 0;
 265:		inode->i_wb_frn_avg_time = 0;
 266:		inode->i_wb_frn_history = 0;
 267:	#endif
 268:	
 269:		spin_lock_init(&inode->i_lock);
 270:		lockdep_set_class(&inode->i_lock, &sb->s_type->i_lock_key);
 271:	
 272:		init_rwsem(&inode->i_rwsem);
 273:		lockdep_set_class(&inode->i_rwsem, &sb->s_type->i_mutex_key);
 274:	
 275:		atomic_set(&inode->i_dio_count, 0);
 276:	
 277:		mapping->a_ops = &empty_aops;
 278:		mapping->host = inode;
 279:		mapping->flags = 0;
 280:		mapping->wb_err = 0;
 281:		atomic_set(&mapping->i_mmap_writable, 0);
 282:	#ifdef CONFIG_READ_ONLY_THP_FOR_FS
 283:		atomic_set(&mapping->nr_thps, 0);
 284:	#endif
 285:		mapping_set_gfp_mask(mapping, GFP_HIGHUSER_MOVABLE);
 286:		mapping->i_private_data = NULL;
 287:		mapping->writeback_index = 0;
 288:		init_rwsem(&mapping->invalidate_lock);
 289:		lockdep_set_class_and_name(&mapping->invalidate_lock,
 290:					   &sb->s_type->invalidate_lock_key,
 291:					   "mapping.invalidate_lock");
 292:		if (sb->s_iflags & SB_I_STABLE_WRITES)
 293:			mapping_set_stable_writes(mapping);
 294:		inode->i_private = NULL;
 295:		inode->i_mapping = mapping;
 296:		INIT_HLIST_HEAD(&inode->i_dentry);	/* buggered by rcu freeing */
 297:	#ifdef CONFIG_FS_POSIX_ACL
 298:		inode->i_acl = inode->i_default_acl = ACL_NOT_CACHED;
 299:	#endif
 300:	
 301:	#ifdef CONFIG_FSNOTIFY
 302:		inode->i_fsnotify_mask = 0;
 303:	#endif
 304:		inode->i_flctx = NULL;
 305:	
 306:		if (unlikely(security_inode_alloc(inode, gfp)))
 307:			return -ENOMEM;
 308:	
 309:		this_cpu_inc(nr_inodes);
 310:	
 311:		return 0;
 312:	}
 SourceFile:fs/inode.c]

gemini-3.1-pro-preview

							input: 67573
							output: 49
							thoughts: 1523
						

**Analyzing a Lockdep Report in the Ext4 Filesystem**

Okay, let's break this down. I'm looking at a lockdep report and trying to understand a potential locking conflict. First, `i_rwsem` is initialized with `&sb->s_type->i_mutex_key`, and by default, its subclass is 0. However, the lockdep report shows `&sb->s_type->i_mutex_key#9/1`. The `#9/1` part is the key. Ah, it's being set in `ext4_xattr_inode_set_class`. So, this `&sb->s_type->i_mutex_key#9/1` is the `i_rwsem` of an Extended Attribute (EA) inode.

The report says: `&sb->s_type->i_mutex_key#9/1` -> `&ei->i_data_sem/3`. This indicates a lock ordering issue: we're taking `inode_lock` on an EA inode (subclass 1) *before* `i_data_sem` (subclass 3) on the same EA inode. We already know that `vfs_setxattr` takes `inode_lock` of the file. If the file is an EA inode, it takes `inode_lock(ea_inode)` which is subclass 1. But `ext4_lookup` and `ext4_iget` prevent us from accessing EA inodes as normal files. How, then, can `vfs_setxattr` be called on an EA inode?

Let's look at the reproducer. The path in the `setxattr` call is `./file0/file0`. I wonder if `./file0` is a directory and `./file0/file0` is a normal file. If `./file0/file0` is a normal file, its `inode_lock` is subclass 0. Then, why is the lockdep report showing `&sb->s_type->i_mutex_key#9/1`?

Wait! Let's examine the stack trace for acquiring `&sb->s_type->i_mutex_key#9/1`.  It's acquired in `ext4_xattr_inode_create`. And the task is already holding `&ei->i_data_sem/3`, at: `ext4_truncate`. So `ext4_truncate` is holding `&ei->i_data_sem/3`. This means `ext4_truncate` is being called on an EA inode! How is that possible?  The call chain is `do_unlinkat` -> `evict` -> `ext4_evict_inode` -> `ext4_truncate`. If `do_unlinkat` unlinks an EA inode, it calls `evict`.  But again, we just said that `ext4_lookup` rejects EA inodes! So `do_unlinkat` can't directly unlink an EA inode!

Aha! What if the EA inode is *indirectly* unlinked by ext4? When a normal file is unlinked, its associated EA inode *must* also be unlinked. Let's look at `ext4_xattr_inode_dec_ref`. I think this is the key.

map[ContextFile:fs/ext4/xattr.c IncludeLines:true Name:ext4_xattr_inode_dec_ref]

map[SourceCode:1074:	static int ext4_xattr_inode_dec_ref(handle_t *handle, struct inode *ea_inode)
1075:	{
1076:		return ext4_xattr_inode_update_ref(handle, ea_inode, -1);
1077:	}
 SourceFile:fs/ext4/xattr.c]

gemini-3.1-pro-preview

							input: 69972
							output: 49
							thoughts: 17
						

Okay, let's dive into this. Here's my thought process on what we're looking at, summarized from the inside:

**Analyzing `ext4_xattr_inode_update_ref`**

Alright, time to get my head in the game. First thing I'm doing is zeroing in on `ext4_xattr_inode_update_ref`. This likely relates to how extended attributes (xattrs) are handled on an ext4 filesystem, specifically when a reference count needs updating on the inode related to the xattr data. My initial understanding is that this function probably orchestrates the mechanics of adjusting reference counters. Now I'm mentally parsing the specifics. I'm keen to see if this handles the increment or decrement of that counter. Also, what are the conditions that trigger an update? And crucially, what kind of locking is used here? Is it inode-level, block-level, or something more granular? I'm already anticipating the potential for contention and race conditions when multiple processes are dealing with xattrs simultaneously. Let's see how they've handled that. Digging into this function will hopefully reveal the strategy. It's also likely connected to allocation and deallocation of the xattr data blocks. The interplay between the metadata update and the actual data is critical. So, let's get started.

map[ContextFile:fs/ext4/xattr.c IncludeLines:true Name:ext4_xattr_inode_update_ref]

map[SourceCode:1018:	static int ext4_xattr_inode_update_ref(handle_t *handle, struct inode *ea_inode,
1019:					       int ref_change)
1020:	{
1021:		struct ext4_iloc iloc;
1022:		s64 ref_count;
1023:		int ret;
1024:	
1025:		inode_lock_nested(ea_inode, I_MUTEX_XATTR);
1026:	
1027:		ret = ext4_reserve_inode_write(handle, ea_inode, &iloc);
1028:		if (ret)
1029:			goto out;
1030:	
1031:		ref_count = ext4_xattr_inode_get_ref(ea_inode);
1032:		ref_count += ref_change;
1033:		ext4_xattr_inode_set_ref(ea_inode, ref_count);
1034:	
1035:		if (ref_change > 0) {
1036:			WARN_ONCE(ref_count <= 0, "EA inode %lu ref_count=%lld",
1037:				  ea_inode->i_ino, ref_count);
1038:	
1039:			if (ref_count == 1) {
1040:				WARN_ONCE(ea_inode->i_nlink, "EA inode %lu i_nlink=%u",
1041:					  ea_inode->i_ino, ea_inode->i_nlink);
1042:	
1043:				set_nlink(ea_inode, 1);
1044:				ext4_orphan_del(handle, ea_inode);
1045:			}
1046:		} else {
1047:			WARN_ONCE(ref_count < 0, "EA inode %lu ref_count=%lld",
1048:				  ea_inode->i_ino, ref_count);
1049:	
1050:			if (ref_count == 0) {
1051:				WARN_ONCE(ea_inode->i_nlink != 1,
1052:					  "EA inode %lu i_nlink=%u",
1053:					  ea_inode->i_ino, ea_inode->i_nlink);
1054:	
1055:				clear_nlink(ea_inode);
1056:				ext4_orphan_add(handle, ea_inode);
1057:			}
1058:		}
1059:	
1060:		ret = ext4_mark_iloc_dirty(handle, ea_inode, &iloc);
1061:		if (ret)
1062:			ext4_warning_inode(ea_inode,
1063:					   "ext4_mark_iloc_dirty() failed ret=%d", ret);
1064:	out:
1065:		inode_unlock(ea_inode);
1066:		return ret;
1067:	}
 SourceFile:fs/ext4/xattr.c]

gemini-3.1-pro-preview

							input: 71160
							output: 42
							thoughts: 953
						

**Decoding the Lockdep Report: An Extended Attribute Conundrum**

Okay, let's break this down. My initial thought was that `clear_nlink` triggers the cascade: refcount to zero, `iput`, then `evict`, leading to `ext4_evict_inode` and ultimately, `ext4_truncate`.  I recall that `iput(ea_inode)` should be called when we drop the last reference to an EA inode. But `ext4_xattr_inode_dec_ref` *just* decrements the refcount; the `iput` is called elsewhere.  Specifically, `ext4_xattr_block_set` gives us a clear example of `iput` being called after the reference count is decreased. If the refcount goes to zero then `evict` is called.

The lockdep report is what throws me off: it shows `evict` called from `do_unlinkat`. That's unexpected. How can `do_unlinkat`, which I thought wouldn't be able to access an EA inode, cause the eviction of an EA inode? `ext4_lookup` should have rejected EA inodes... unless it's not *initially* an EA inode.

If the inode is a *normal* file when looked up, how does it become an EA inode? It shouldn't...unless. What if `do_unlinkat` is called on a normal file? Then `ext4_truncate` acquires `&ei->i_data_sem` on a *normal* file (subclass 0), which seems fine. But then `ext4_try_to_expand_extra_isize` creates a *new* EA inode. This *new* EA inode has `inode_lock` (subclass 1), so the expected dependency should be `&ei->i_data_sem` (subclass 0) -> `&sb->s_type->i_mutex_key#9/1`. The lockdep report *doesn't* show that.

The lockdep report indicates `&ei->i_data_sem/3` – subclass 3. A normal file shouldn't have subclass 3. How could this happen? Could `ext4_xattr_inode_set_class` have been called on the normal file *before* the call to `ext4_truncate`? Where is `ext4_xattr_inode_set_class` called?  It's only called in `ext4_xattr_inode_create` and `ext4_xattr_inode_iget`.  If it's in `ext4_xattr_inode_iget`, the inode was fetched as an EA inode. I thought we'd already established that `ext4_xattr_inode_iget` rejects normal files? (missing `EXT4_EA_INODE_FL`).  

Unless, wait! The file *has* `EXT4_EA_INODE_FL`, but it was accessed *without* it being treated as an EA inode.  But, going back to what we said earlier, `ext4_lookup` rejects files that have `EXT4_EA_INODE_FL`... Okay, let's look at `check_igot_inode` again.

map[ContextFile:fs/ext4/inode.c IncludeLines:true Name:check_igot_inode]

map[SourceCode:5139:	static int check_igot_inode(struct inode *inode, ext4_iget_flags flags,
5140:				    const char *function, unsigned int line)
5141:	{
5142:		const char *err_str;
5143:	
5144:		if (flags & EXT4_IGET_EA_INODE) {
5145:			if (!(EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL)) {
5146:				err_str = "missing EA_INODE flag";
5147:				goto error;
5148:			}
5149:			if (ext4_test_inode_state(inode, EXT4_STATE_XATTR) ||
5150:			    EXT4_I(inode)->i_file_acl) {
5151:				err_str = "ea_inode with extended attributes";
5152:				goto error;
5153:			}
5154:		} else {
5155:			if ((EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL)) {
5156:				/*
5157:				 * open_by_handle_at() could provide an old inode number
5158:				 * that has since been reused for an ea_inode; this does
5159:				 * not indicate filesystem corruption
5160:				 */
5161:				if (flags & EXT4_IGET_HANDLE)
5162:					return -ESTALE;
5163:				err_str = "unexpected EA_INODE flag";
5164:				goto error;
5165:			}
5166:		}
5167:		if (is_bad_inode(inode) && !(flags & EXT4_IGET_BAD)) {
5168:			err_str = "unexpected bad inode w/o EXT4_IGET_BAD";
5169:			goto error;
5170:		}
5171:		return 0;
5172:	
5173:	error:
5174:		ext4_error_inode(inode, function, line, 0, "%s", err_str);
5175:		return -EFSCORRUPTED;
5176:	}
 SourceFile:fs/ext4/inode.c]

gemini-3.1-pro-preview

							input: 73488
							output: 21
							thoughts: 441
						

**The Puzzle of the Corrupted Inode and Lockdep Misdirection**

Okay, so I'm seeing a potential flaw in the extended attribute (EA) handling within the ext4 filesystem. Let's break this down. It seems that `check_igot_inode` throws a `-EFSCORRUPTED` error if an inode has `EXT4_EA_INODE_FL` set, and the `EXT4_IGET_EA_INODE` flag isn't set, as one would expect. But, here's the catch... what if the inode is *already* in the cache, and it's been fetched *as* an EA inode initially?

Let's say `ext4_lookup` finds it and then calls `ext4_iget` with `EXT4_IGET_NORMAL`. `__ext4_iget` finds our inode in the cache, it then calls `check_igot_inode`. `check_igot_inode` then sees that `EXT4_EA_INODE_FL` is set on that inode, and the flag `EXT4_IGET_EA_INODE` is *not* set. The function then throws an `-EFSCORRUPTED` error.

So, this means that the `ext4_lookup` function will fail with an `-EFSCORRUPTED` error. This then means that `do_unlinkat` can't unlink it!

But, what happens with a normal file in the cache? If someone calls `setxattr` on it, then a new EA inode is created. It doesn't transform the existing inode. Now let's say `setxattr` is called on `./file0/file0` and it successfully creates a new EA inode. Then `do_unlinkat` is called on `./file0/file0`. The original entry *was* a normal file. This means the `ext4_truncate` function grabs `&ei->i_data_sem` from `./file0/file0`. It's a normal file, so it should have subclass 0!

But, the lockdep report references `&ei->i_data_sem/3`! How can that normal file have a subclass of 3? This seems to indicate a misattribution of the lock subclass. I need to figure out where this is coming from. Is there anywhere *else* in the code where `lockdep_set_subclass(&ei->i_data_sem, I_DATA_SEM_EA)` is called? I need to check!

map[Expression:I_DATA_SEM_EA]

map[Output:fs/ext4/ext4.h=956=do {										\
--
fs/ext4/ext4.h-1009- *  I_DATA_SEM_QUOTA  - Used for quota inodes only
fs/ext4/ext4.h:1010: *  I_DATA_SEM_EA     - Used for ea_inodes only
fs/ext4/ext4.h-1011- */
fs/ext4/ext4.h=1012=enum {
--
fs/ext4/ext4.h-1015-	I_DATA_SEM_QUOTA,
fs/ext4/ext4.h:1016:	I_DATA_SEM_EA
fs/ext4/ext4.h-1017-};
--
fs/ext4/xattr.c=122=void ext4_xattr_inode_set_class(struct inode *ea_inode)
--
fs/ext4/xattr.c-127-	(void) ei;	/* shut up clang warning if !CONFIG_LOCKDEP */
fs/ext4/xattr.c:128:	lockdep_set_subclass(&ei->i_data_sem, I_DATA_SEM_EA);
fs/ext4/xattr.c-129-}
]

gemini-3.1-pro-preview

							input: 74826
							output: 49
							thoughts: 2403
						

**Analyzing a Potential Lockdep Conflict in ext4 Xattr and Truncate Operations**

Okay, let's break this down. It seems I've got a lockdep issue surfacing within the ext4 filesystem, specifically in the context of extended attributes (EAs) and file truncation, and I'm trying to wrap my head around a potential race condition or incorrect lock class assignment.

First, I'm focusing on `ext4_xattr_inode_set_class`. I see it's only called by `ext4_xattr_inode_create` and `ext4_xattr_inode_iget`. That tells me the inode in question *must* have been either created as an EA inode or retrieved as one. The key thing is that if it was created that way, it shouldn't be in the directory tree. Also, If it was fetched as an EA inode, it still shouldn't be in the directory tree. So, I thought, how can `do_unlinkat` be operating on such an inode? I realized it's operating on `./file0/file0`.

Then I pondered hardlinks. I initially thought, maybe `./file0/file0` is a hardlink to the EA inode? However, I know a crafted image with an EA inode pointed to by a directory entry will cause `ext4_lookup` to return `-EFSCORRUPTED`. And even if the EA inode isn't flagged on disk, but `ext4_xattr_inode_iget` fetches it as one, I know that if the file is not flagged `EXT4_EA_INODE_FL`, it will also return `-EFSCORRUPTED`.

So, the inode shouldn't be fetchable if it's not a valid EA inode. Now, my mind races to the opposite situation, where the inode *does* have `EXT4_EA_INODE_FL` on disk. But if this is the case, `ext4_lookup` will *still* return `-EFSCORRUPTED`, making it impossible to access via lookup. So, how can `do_unlinkat` be called on it?

Aha! `./file0/file0` *isn't* the EA inode. It's a normal file, which `do_unlinkat` is unlinking. This leads to `evict` being called, then `ext4_evict_inode`, and finally, `ext4_truncate` on `./file0/file0`.

Now, here's where things get interesting. If `./file0/file0` is a normal file, its `i_data_sem` should be subclass 0. But the lockdep report says `&ei->i_data_sem/3`! This is where I'm getting lost. The stack trace seems to indicate that the lock in question, `&ei->i_data_sem/3`, is being acquired in `ext4_xattr_inode_write`. And the lock *class* is `&ei->i_data_sem/3`. This makes sense, because that function is called for EA inodes.

However, the other trace shows `ext4_truncate` is being called and is also holding the lock `&ei->i_data_sem/3`, which is unexpected. This stack trace reveals `&sb->s_type->i_mutex_key#9/1` lock is acquired in `ext4_xattr_inode_create`, while the trace shows the task already holds `&ei->i_data_sem/3`!

I rechecked the information. If `ext4_truncate` is called on a normal file, it *should* hold `&ei->i_data_sem` (subclass 0), but the lockdep report says it holds subclass 3. I'm trying to figure out if it is possible the normal file's `i_data_sem` was initialized with subclass 3. This doesn't seem likely because it should be subclass 0. Maybe the report is merging lock classes? I checked and the lockdep report should report the exact subclass!

I thought for a moment, could `ext4_truncate` be called on an EA inode? Yes, if that EA inode is unlinked! I know that a normal file's EA inode is unlinked with the normal file, but how is this possible, since `ext4_lookup` should reject an EA inode? Well, what if the EA inode is unlinked internally by ext4 after the normal file? I remembered the following code block:

```c
	if (ref_count == 0) {
		clear_nlink(ea_inode);
		ext4_orphan_add(handle, ea_inode);
	}
```

map[ContextFile:fs/ext4/xattr.c IncludeLines:true Name:ext4_xattr_inode_set_class]

map[SourceCode: 122:	void ext4_xattr_inode_set_class(struct inode *ea_inode)
 123:	{
 124:		struct ext4_inode_info *ei = EXT4_I(ea_inode);
 125:	
 126:		lockdep_set_subclass(&ea_inode->i_rwsem, 1);
 127:		(void) ei;	/* shut up clang warning if !CONFIG_LOCKDEP */
 128:		lockdep_set_subclass(&ei->i_data_sem, I_DATA_SEM_EA);
 129:	}
 SourceFile:fs/ext4/xattr.c]

gemini-3.1-pro-preview

							input: 78493
							output: 44
							thoughts: 522
						

**Investigating the Unexpected EA_INODE Flag**

Okay, so I'm trying to figure out how a normal file could possibly end up with the `EXT4_EA_INODE_FL` flag set. The initial hunch is that `ext4_xattr_inode_set_class` was somehow called on a regular file. Now, where is `ext4_xattr_inode_set_class` called? It's within `ext4_xattr_inode_create` and `ext4_xattr_inode_iget`. If `ext4_xattr_inode_iget` were involved, wouldn't that mean the normal file was being treated as an EA inode?

But hold on! We know that `ext4_xattr_inode_iget` explicitly rejects normal files that lack `EXT4_EA_INODE_FL`. So, what if, hypothetically, a normal file *did* have the `EXT4_EA_INODE_FL` flag? If it did, wouldn't `ext4_lookup` reject it?

But what if the file wasn't looked up via `ext4_lookup` in the first place? Could it be the ROOT inode? Now, `ext4_fill_super` calls `ext4_iget(sb, EXT4_ROOT_INO, EXT4_IGET_SPECIAL)`. Let's check `check_igot_inode`:

```c
	} else {
		if ((EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL)) {
			if (flags & EXT4_IGET_HANDLE)
				return -ESTALE;
			err_str = "unexpected EA_INODE flag";
			goto error;
		}
	}
```

So, if the root inode had `EXT4_EA_INODE_FL`, `check_igot_inode` would reject it! Okay, the root inode cannot have `EXT4_EA_INODE_FL`. That's a relief.

Now, what if the file was created using `open(O_CREAT)`? `open(O_CREAT)` calls `ext4_create`, which in turn calls `ext4_new_inode_want_edir`. This creates a new inode, and crucially, it *doesn't* set `EXT4_EA_INODE_FL`. So, the newly created inode is, as expected, a regular file.

So, how can a normal file have this flag? Ah, a thought! What if `EXT4_EA_INODE_FL` is set through `ioctl(EXT4_IOC_SETFLAGS)`? That's the key. I need to look at `ext4_ioctl_setflags` to understand how this flag could be modified after the file's initial creation.

map[ContextFile:fs/ext4/ioctl.c IncludeLines:true Name:ext4_ioctl_setflags]

map[SourceCode: 586:	static int ext4_ioctl_setflags(struct inode *inode,
 587:				       unsigned int flags)
 588:	{
 589:		struct ext4_inode_info *ei = EXT4_I(inode);
 590:		handle_t *handle = NULL;
 591:		int err = -EPERM, migrate = 0;
 592:		struct ext4_iloc iloc;
 593:		unsigned int oldflags, mask, i;
 594:		struct super_block *sb = inode->i_sb;
 595:	
 596:		/* Is it quota file? Do not allow user to mess with it */
 597:		if (ext4_is_quota_file(inode))
 598:			goto flags_out;
 599:	
 600:		oldflags = ei->i_flags;
 601:		/*
 602:		 * The JOURNAL_DATA flag can only be changed by
 603:		 * the relevant capability.
 604:		 */
 605:		if ((flags ^ oldflags) & (EXT4_JOURNAL_DATA_FL)) {
 606:			if (!capable(CAP_SYS_RESOURCE))
 607:				goto flags_out;
 608:		}
 609:	
 610:		if (!dax_compatible(inode, oldflags, flags)) {
 611:			err = -EOPNOTSUPP;
 612:			goto flags_out;
 613:		}
 614:	
 615:		if ((flags ^ oldflags) & EXT4_EXTENTS_FL)
 616:			migrate = 1;
 617:	
 618:		if ((flags ^ oldflags) & EXT4_CASEFOLD_FL) {
 619:			if (!ext4_has_feature_casefold(sb)) {
 620:				err = -EOPNOTSUPP;
 621:				goto flags_out;
 622:			}
 623:	
 624:			if (!S_ISDIR(inode->i_mode)) {
 625:				err = -ENOTDIR;
 626:				goto flags_out;
 627:			}
 628:	
 629:			if (!ext4_empty_dir(inode)) {
 630:				err = -ENOTEMPTY;
 631:				goto flags_out;
 632:			}
 633:		}
 634:	
 635:		/*
 636:		 * Wait for all pending directio and then flush all the dirty pages
 637:		 * for this file.  The flush marks all the pages readonly, so any
 638:		 * subsequent attempt to write to the file (particularly mmap pages)
 639:		 * will come through the filesystem and fail.
 640:		 */
 641:		if (S_ISREG(inode->i_mode) && !IS_IMMUTABLE(inode) &&
 642:		    (flags & EXT4_IMMUTABLE_FL)) {
 643:			inode_dio_wait(inode);
 644:			err = filemap_write_and_wait(inode->i_mapping);
 645:			if (err)
 646:				goto flags_out;
 647:		}
 648:	
 649:		handle = ext4_journal_start(inode, EXT4_HT_INODE, 1);
 650:		if (IS_ERR(handle)) {
 651:			err = PTR_ERR(handle);
 652:			goto flags_out;
 653:		}
 654:		if (IS_SYNC(inode))
 655:			ext4_handle_sync(handle);
 656:		err = ext4_reserve_inode_write(handle, inode, &iloc);
 657:		if (err)
 658:			goto flags_err;
 659:	
 660:		ext4_dax_dontcache(inode, flags);
 661:	
 662:		for (i = 0, mask = 1; i < 32; i++, mask <<= 1) {
 663:			if (!(mask & EXT4_FL_USER_MODIFIABLE))
 664:				continue;
 665:			/* These flags get special treatment later */
 666:			if (mask == EXT4_JOURNAL_DATA_FL || mask == EXT4_EXTENTS_FL)
 667:				continue;
 668:			if (mask & flags)
 669:				ext4_set_inode_flag(inode, i);
 670:			else
 671:				ext4_clear_inode_flag(inode, i);
 672:		}
 673:	
 674:		ext4_set_inode_flags(inode, false);
 675:	
 676:		inode_set_ctime_current(inode);
 677:		inode_inc_iversion(inode);
 678:	
 679:		err = ext4_mark_iloc_dirty(handle, inode, &iloc);
 680:	flags_err:
 681:		ext4_journal_stop(handle);
 682:		if (err)
 683:			goto flags_out;
 684:	
 685:		if ((flags ^ oldflags) & (EXT4_JOURNAL_DATA_FL)) {
 686:			/*
 687:			 * Changes to the journaling mode can cause unsafe changes to
 688:			 * S_DAX if the inode is DAX
 689:			 */
 690:			if (IS_DAX(inode)) {
 691:				err = -EBUSY;
 692:				goto flags_out;
 693:			}
 694:	
 695:			err = ext4_change_inode_journal_flag(inode,
 696:							     flags & EXT4_JOURNAL_DATA_FL);
 697:			if (err)
 698:				goto flags_out;
 699:		}
 700:		if (migrate) {
 701:			if (flags & EXT4_EXTENTS_FL)
 702:				err = ext4_ext_migrate(inode);
 703:			else
 704:				err = ext4_ind_migrate(inode);
 705:		}
 706:	
 707:	flags_out:
 708:		return err;
 709:	}
 SourceFile:fs/ext4/ioctl.c]

gemini-3.1-pro-preview

							input: 81479
							output: 24
							thoughts: 50
						

**Checking User-Modifiable Extended Attribute Inode Flags**

Okay, so I'm diving into this flag modification stuff in ext4. Right now, I need to figure out which flags the user can actually tweak. `EXT4_FL_USER_MODIFIABLE` is the key, that's the bitmask I'm interested in. Now the question is, is `EXT4_EA_INODE_FL` included within the set of flags that are considered user-modifiable. It's time to check if that flag is part of the `EXT4_FL_USER_MODIFIABLE` set. That's the next logical step. I need to verify that specific flag's user-modifiable status within the broader context.

map[Expression:EXT4_FL_USER_MODIFIABLE]

map[Output:Documentation/filesystems/ext4/inodes.rst=228=The ``i_flags`` field is a combination of these values:
--
Documentation/filesystems/ext4/inodes.rst-308-       EXT4_EXTENTS_FL can be set with setattr, they are not in the kernel's
Documentation/filesystems/ext4/inodes.rst:309:       EXT4_FL_USER_MODIFIABLE mask, since it needs to handle the setting of
Documentation/filesystems/ext4/inodes.rst-310-       these flags in a special manner and they are masked out of the set of
--
fs/ext4/ext4.h=433=struct flex_groups {
--
fs/ext4/ext4.h-508-/* User modifiable flags */
fs/ext4/ext4.h:509:#define EXT4_FL_USER_MODIFIABLE		(EXT4_SECRM_FL | \
fs/ext4/ext4.h-510-					 EXT4_UNRM_FL | \
--
fs/ext4/ext4.h-527-/* User visible flags */
fs/ext4/ext4.h:528:#define EXT4_FL_USER_VISIBLE		(EXT4_FL_USER_MODIFIABLE | \
fs/ext4/ext4.h-529-					 EXT4_DIRTY_FL | \
--
fs/ext4/ioctl.c=586=static int ext4_ioctl_setflags(struct inode *inode,
--
fs/ext4/ioctl.c-662-	for (i = 0, mask = 1; i < 32; i++, mask <<= 1) {
fs/ext4/ioctl.c:663:		if (!(mask & EXT4_FL_USER_MODIFIABLE))
fs/ext4/ioctl.c-664-			continue;
--
fs/ext4/ioctl.c=999=int ext4_fileattr_set(struct mnt_idmap *idmap,
--
fs/ext4/ioctl.c-1014-	 */
fs/ext4/ioctl.c:1015:	flags &= EXT4_FL_USER_MODIFIABLE;
fs/ext4/ioctl.c-1016-	if (ext4_mask_flags(inode->i_mode, flags) != flags)
]

gemini-3.1-pro-preview

							input: 82298
							output: 48
							thoughts: 20
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Investigating `EXT4_FL_USER_MODIFIABLE`**

Okay, time to dig into this. I need to understand what `EXT4_FL_USER_MODIFIABLE` represents. This likely involves checking the kernel headers or relevant source code to see how it's defined and, more importantly, how it's used within the ext4 filesystem implementation. I'm assuming it's a file attribute flag, but I need to confirm that. Knowing the numerical value or bit position is key; that tells me the actual mechanism involved. I'll need to correlate the definition with any associated locking or permission checks. Are we talking about user-level modification of file flags? If so, what are the implications for security and data integrity? I suspect that this might impact how users can manipulate specific file attributes, such as whether they can set immutable files or append-only flags. I’ll also need to consider any potential interactions with tools like `chattr` and how this flag plays into the overall design of the ext4 filesystem. Understanding the granular control enabled by this flag is important. I’ll start by tracing its use through the relevant kernel code, looking for functions like `setattr` or `ioctl` handling, to see how the attribute is interpreted and applied.

requested entity does not exist

map[ContextFile:fs/ext4/ext4.h IncludeLines:true Name:EXT4_FL_USER_MODIFIABLE]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 82672
							output: 25
							thoughts: 32
						

Here's my summary, as the thought process unfolds:

**Grepping for User-Modifiable Flags in EXT4**

Okay, so I need to understand how user-modifiable flags are handled within the EXT4 filesystem. My first instinct is to dive into the core header file, `fs/ext4/ext4.h`. Specifically, I'm hunting for the definition or declaration of the flag that signifies user modifiability. I'll use `grep` for this. I'll search for `EXT4_FL_USER_MODIFIABLE`. This is a pretty standard way to look for a specific constant or macro definition within a codebase. I'll need some context around that line to fully understand its meaning and usage, so I'll be sure to include that in the search. That will help me better understand how the kernel utilizes this flag.

map[Expression:define EXT4_FL_USER_MODIFIABLE]

map[Output:fs/ext4/ext4.h=433=struct flex_groups {
--
fs/ext4/ext4.h-508-/* User modifiable flags */
fs/ext4/ext4.h:509:#define EXT4_FL_USER_MODIFIABLE		(EXT4_SECRM_FL | \
fs/ext4/ext4.h-510-					 EXT4_UNRM_FL | \
]

gemini-3.1-pro-preview

							input: 83027
							output: 24
							thoughts: 25
						

Okay, let's dive into this. Here's my take on those lines from `fs/ext4/ext4.h`:

**Analyzing ext4.h: A Deep Dive**

Alright, I need to get a handle on what's going on in this part of `ext4.h`. Lines 509-520, got it. I'm expecting this to likely deal with some key structure definition, macro, or constant related to the file system's internal workings. Given the line range, it’s probably a critical part of the metadata management or block allocation process. Let's see... I'm already mentally running through the various data structures I know are commonly defined in these types of header files: i-node structures, block group descriptors, file system superblocks, possibly some related bitmask definitions, or maybe even error codes. I'm hoping to find something that gives me clarity, or at least a good anchor point in my analysis. Let's read and see what we get!

map[Expression:EXT4_FL_USER_MODIFIABLE]

map[Output:Documentation/filesystems/ext4/inodes.rst=228=The ``i_flags`` field is a combination of these values:
--
Documentation/filesystems/ext4/inodes.rst-308-       EXT4_EXTENTS_FL can be set with setattr, they are not in the kernel's
Documentation/filesystems/ext4/inodes.rst:309:       EXT4_FL_USER_MODIFIABLE mask, since it needs to handle the setting of
Documentation/filesystems/ext4/inodes.rst-310-       these flags in a special manner and they are masked out of the set of
--
fs/ext4/ext4.h=433=struct flex_groups {
--
fs/ext4/ext4.h-508-/* User modifiable flags */
fs/ext4/ext4.h:509:#define EXT4_FL_USER_MODIFIABLE		(EXT4_SECRM_FL | \
fs/ext4/ext4.h-510-					 EXT4_UNRM_FL | \
--
fs/ext4/ext4.h-527-/* User visible flags */
fs/ext4/ext4.h:528:#define EXT4_FL_USER_VISIBLE		(EXT4_FL_USER_MODIFIABLE | \
fs/ext4/ext4.h-529-					 EXT4_DIRTY_FL | \
--
fs/ext4/ioctl.c=586=static int ext4_ioctl_setflags(struct inode *inode,
--
fs/ext4/ioctl.c-662-	for (i = 0, mask = 1; i < 32; i++, mask <<= 1) {
fs/ext4/ioctl.c:663:		if (!(mask & EXT4_FL_USER_MODIFIABLE))
fs/ext4/ioctl.c-664-			continue;
--
fs/ext4/ioctl.c=999=int ext4_fileattr_set(struct mnt_idmap *idmap,
--
fs/ext4/ioctl.c-1014-	 */
fs/ext4/ioctl.c:1015:	flags &= EXT4_FL_USER_MODIFIABLE;
fs/ext4/ioctl.c-1016-	if (ext4_mask_flags(inode->i_mode, flags) != flags)
]

gemini-3.1-pro-preview

							input: 83881
							output: 26
							thoughts: 8
						

Okay, here's the summary, rendered in the first person, assuming I'm an expert in a field and this is my thought process:

**Defining the Parameters**

Alright, I see a request or a problem statement, but it's not immediately clear what's being asked. Before I dive into any analysis or potential solutions, I absolutely *need* to get a complete, unambiguous definition of the scope of this endeavor. I can't even begin to formulate a meaningful response or evaluate the situation properly without a solid foundation. So, the first and most crucial step is to gain clarity. I'm essentially hitting a mental pause and saying, "Hold on – give me the *full* definition. I need all the pieces to see the whole picture." That's the priority right now.

map[Expression:define EXT4_FL_USER_MODIFIABLE.*]

map[Output:fs/ext4/ext4.h=433=struct flex_groups {
--
fs/ext4/ext4.h-508-/* User modifiable flags */
fs/ext4/ext4.h:509:#define EXT4_FL_USER_MODIFIABLE		(EXT4_SECRM_FL | \
fs/ext4/ext4.h-510-					 EXT4_UNRM_FL | \
]

gemini-3.1-pro-preview

							input: 84199
							output: 21
							thoughts: 28
						

Okay, here's my take on those thoughts, framed as a first-person expert summary:

**Analyzing the Potential of `read-file` for `fs/ext4/ext4.h` (around line 509)**

Alright, so the task at hand seems to be optimizing or addressing something within the ext4 filesystem code. The specific interest, as indicated by the reference to `fs/ext4/ext4.h` around line 509, suggests we're likely dealing with some core data structure or function within the EXT4 kernel module. My immediate thought is, what's happening *around* line 509? Is this a crucial data structure declaration, a function call, or perhaps some conditional logic within a performance-sensitive part of the code?

The suggestion to consider `read-file` is particularly intriguing. Given my expertise, I'm already mentally running through potential scenarios. Is this a situation where we are seeking to determine a file type, access permissions, or file data? The intention behind the use of `read-file` is an important consideration. It indicates a clear intent for the use of a simple `read-file` implementation. Could this be for a look-up table or read a configuration file or something of this nature. It implies a read-only context, which is typically good for concurrency and overall efficiency, but begs the question, *why* `read-file` specifically? What is it attempting to achieve over other potential methods? The benefit I see so far is that this can eliminate the need to handle potentially complicated issues, so this is a good place to start.

I need to dig deeper. I need to understand the *specific* problem at hand and the *specific* context of that line of code to make a truly informed decision. Perhaps there's an existing bottleneck, or we're looking to enhance performance, or maybe we're just refactoring for clarity. However, the use of `read-file` around line 509 of `fs/ext4/ext4.h` *has* piqued my interest.

map[Expression:EXT4_SECRM_FL]

map[Output:Documentation/filesystems/ext4/inodes.rst=228=The ``i_flags`` field is a combination of these values:
--
Documentation/filesystems/ext4/inodes.rst-236-   * - 0x1
Documentation/filesystems/ext4/inodes.rst:237:     - This file requires secure deletion (EXT4_SECRM_FL). (not implemented)
Documentation/filesystems/ext4/inodes.rst-238-   * - 0x2
--
fs/ext4/ext4.h=433=struct flex_groups {
--
fs/ext4/ext4.h-473- */
fs/ext4/ext4.h:474:#define	EXT4_SECRM_FL			0x00000001 /* Secure deletion */
fs/ext4/ext4.h-475-#define	EXT4_UNRM_FL			0x00000002 /* Undelete */
--
fs/ext4/ext4.h-508-/* User modifiable flags */
fs/ext4/ext4.h:509:#define EXT4_FL_USER_MODIFIABLE		(EXT4_SECRM_FL | \
fs/ext4/ext4.h-510-					 EXT4_UNRM_FL | \
--
fs/ext4/ext4.h-537-/* Flags that should be inherited by new inodes from their parent. */
fs/ext4/ext4.h:538:#define EXT4_FL_INHERITED (EXT4_SECRM_FL | EXT4_UNRM_FL | EXT4_COMPR_FL |\
fs/ext4/ext4.h-539-			   EXT4_SYNC_FL | EXT4_NODUMP_FL | EXT4_NOATIME_FL |\
]

gemini-3.1-pro-preview

							input: 85144
							output: 24
							thoughts: 25
						

Here's my summary, as if I were thinking these thoughts:

**Analyzing ext4 Header Definitions**

Alright, time to dive into `fs/ext4/ext4.h`. Specifically, I want to take a look at lines 509 through 525. I need to refresh my memory on what specific data structures or macros are defined in that section of the header. I suspect it relates to superblock information or possibly inode management details, but I really need to confirm to proceed. Let's see what we're dealing with. Knowing the kernel code structure, I expect it might have some crucial definitions there related to block sizes, filesystem features, or allocation bitmaps. I should note down anything of particular interest as I go.

map[Expression:EXT4_FL_USER_MODIFIABLE]

map[Output:Documentation/filesystems/ext4/inodes.rst=228=The ``i_flags`` field is a combination of these values:
--
Documentation/filesystems/ext4/inodes.rst-308-       EXT4_EXTENTS_FL can be set with setattr, they are not in the kernel's
Documentation/filesystems/ext4/inodes.rst:309:       EXT4_FL_USER_MODIFIABLE mask, since it needs to handle the setting of
Documentation/filesystems/ext4/inodes.rst-310-       these flags in a special manner and they are masked out of the set of
--
fs/ext4/ext4.h=433=struct flex_groups {
--
fs/ext4/ext4.h-508-/* User modifiable flags */
fs/ext4/ext4.h:509:#define EXT4_FL_USER_MODIFIABLE		(EXT4_SECRM_FL | \
fs/ext4/ext4.h-510-					 EXT4_UNRM_FL | \
--
fs/ext4/ext4.h-527-/* User visible flags */
fs/ext4/ext4.h:528:#define EXT4_FL_USER_VISIBLE		(EXT4_FL_USER_MODIFIABLE | \
fs/ext4/ext4.h-529-					 EXT4_DIRTY_FL | \
--
fs/ext4/ioctl.c=586=static int ext4_ioctl_setflags(struct inode *inode,
--
fs/ext4/ioctl.c-662-	for (i = 0, mask = 1; i < 32; i++, mask <<= 1) {
fs/ext4/ioctl.c:663:		if (!(mask & EXT4_FL_USER_MODIFIABLE))
fs/ext4/ioctl.c-664-			continue;
--
fs/ext4/ioctl.c=999=int ext4_fileattr_set(struct mnt_idmap *idmap,
--
fs/ext4/ioctl.c-1014-	 */
fs/ext4/ioctl.c:1015:	flags &= EXT4_FL_USER_MODIFIABLE;
fs/ext4/ioctl.c-1016-	if (ext4_mask_flags(inode->i_mode, flags) != flags)
]

gemini-3.1-pro-preview

							input: 85936
							output: 25
							thoughts: 21
						

Okay, here's my interpretation of that thought process, tailored for an expert audience, and presented as if it were my own:

**Quick Definition Check with Grep**

Alright, I need to refresh my memory on a specific definition or usage. No need to get bogged down in a deep dive right now. My first instinct, given I'm comfortable in the command line, is to reach for `grepper`. I can quickly scan for relevant documentation or code examples. A basic `grep` with a sensible context window will do the trick. I'll use the `-A 15` flag, just to make sure I capture enough surrounding lines for clarity. Fifteen lines of context should be more than sufficient to jog my memory without overwhelming me with extraneous information. This should give me a quick understanding and get me back on track. If it's something more complex, I can always refine my search from there. But this is the low-hanging fruit, the efficient first pass.

map[Expression:define EXT4_FL_USER_MODIFIABLE]

map[Output:fs/ext4/ext4.h=433=struct flex_groups {
--
fs/ext4/ext4.h-508-/* User modifiable flags */
fs/ext4/ext4.h:509:#define EXT4_FL_USER_MODIFIABLE		(EXT4_SECRM_FL | \
fs/ext4/ext4.h-510-					 EXT4_UNRM_FL | \
]

gemini-3.1-pro-preview

							input: 86303
							output: 24
							thoughts: 34
						

Okay, here's my thought process on that:

**Quick Problem-Solving & Tool Adaptation**

Alright, hang on a second. I was about to reach for `grepper` and try to use the `-A` option for some context, but it seems like `grepper` isn't going to cooperate with that specific flag. Hmm, no problem. I can quickly pivot. Instead of trying to force it, I can just use `read-file` directly on the `fs/ext4/ext4.h` file. That'll get me what I need just as efficiently, and I won't have to fiddle with an awkward workaround. It's a faster, cleaner solution given the constraints.

map[File:fs/ext4/ext4.h]

map[Contents:// SPDX-License-Identifier: GPL-2.0
/*
 *  ext4.h
 *
 * Copyright (C) 1992, 1993, 1994, 1995
 * Remy Card (card@masi.ibp.fr)
 * Laboratoire MASI - Institut Blaise Pascal
 * Universite Pierre et Marie Curie (Paris VI)
 *
 *  from
 *
 *  linux/include/linux/minix_fs.h
 *
 *  Copyright (C) 1991, 1992  Linus Torvalds
 */

#ifndef _EXT4_H
#define _EXT4_H

#include <linux/refcount.h>
#include <linux/types.h>
#include <linux/blkdev.h>
#include <linux/magic.h>
#include <linux/jbd2.h>
#include <linux/quota.h>
#include <linux/rwsem.h>
#include <linux/rbtree.h>
#include <linux/seqlock.h>
#include <linux/mutex.h>
#include <linux/timer.h>
#include <linux/wait.h>
#include <linux/sched/signal.h>
#include <linux/blockgroup_lock.h>
#include <linux/percpu_counter.h>
#include <linux/ratelimit.h>
#include <linux/crc32c.h>
#include <linux/falloc.h>
#include <linux/percpu-rwsem.h>
#include <linux/fiemap.h>
#ifdef __KERNEL__
#include <linux/compat.h>
#endif
#include <uapi/linux/ext4.h>

#include <linux/fscrypt.h>
#include <linux/fsverity.h>

#include <linux/compiler.h>

/*
 * The fourth extended filesystem constants/structures
 */

/*
 * with AGGRESSIVE_CHECK allocator runs consistency checks over
 * structures. these checks slow things down a lot
 */
#define AGGRESSIVE_CHECK__

/*
 * with DOUBLE_CHECK defined mballoc creates persistent in-core
 * bitmaps, maintains and uses them to check for double allocations
 */
#define DOUBLE_CHECK__

/*
 * Define EXT4FS_DEBUG to produce debug messages
 */
#undef EXT4FS_DEBUG

/*
 * Debug code
 */
#ifdef EXT4FS_DEBUG
#define ext4_debug(f, a...)						\
	do {								\
		printk(KERN_DEBUG "EXT4-fs DEBUG (%s, %d): %s:",	\
			__FILE__, __LINE__, __func__);			\
		printk(KERN_DEBUG f, ## a);				\
	} while (0)
#else
#define ext4_debug(fmt, ...)	no_printk(fmt, ##__VA_ARGS__)
#endif

 /*
  * Turn on EXT_DEBUG to enable ext4_ext_show_path/leaf/move in extents.c
  */
#define EXT_DEBUG__

/*
 * Dynamic printk for controlled extents debugging.
 */
#ifdef CONFIG_EXT4_DEBUG
#define ext_debug(ino, fmt, ...)					\
	pr_debug("[%s/%d] EXT4-fs (%s): ino %lu: (%s, %d): %s:" fmt,	\
		 current->comm, task_pid_nr(current),			\
		 ino->i_sb->s_id, ino->i_ino, __FILE__, __LINE__,	\
		 __func__, ##__VA_ARGS__)
#else
#define ext_debug(ino, fmt, ...)	no_printk(fmt, ##__VA_ARGS__)
#endif

#define ASSERT(assert)						\
do {									\
	if (unlikely(!(assert))) {					\
		printk(KERN_EMERG					\
		       "Assertion failure in %s() at %s:%d: '%s'\n",	\
		       __func__, __FILE__, __LINE__, #assert);		\
		BUG();							\
	}								\
} while (0)

/* data type for block offset of block group */
typedef int ext4_grpblk_t;

/* data type for filesystem-wide blocks number */
typedef unsigned long long ext4_fsblk_t;

/* data type for file logical block number */
typedef __u32 ext4_lblk_t;

/* data type for block group number */
typedef unsigned int ext4_group_t;

enum SHIFT_DIRECTION {
	SHIFT_LEFT = 0,
	SHIFT_RIGHT,
};

/*
 * For each criteria, mballoc has slightly different way of finding
 * the required blocks nad usually, higher the criteria the slower the
 * allocation.  We start at lower criterias and keep falling back to
 * higher ones if we are not able to find any blocks.  Lower (earlier)
 * criteria are faster.
 */
enum criteria {
	/*
	 * Used when number of blocks needed is a power of 2. This
	 * doesn't trigger any disk IO except prefetch and is the
	 * fastest criteria.
	 */
	CR_POWER2_ALIGNED,

	/*
	 * Tries to lookup in-memory data structures to find the most
	 * suitable group that satisfies goal request. No disk IO
	 * except block prefetch.
	 */
	CR_GOAL_LEN_FAST,

        /*
	 * Same as CR_GOAL_LEN_FAST but is allowed to reduce the goal
         * length to the best available length for faster allocation.
	 */
	CR_BEST_AVAIL_LEN,

	/*
	 * Reads each block group sequentially, performing disk IO if
	 * necessary, to find suitable block group. Tries to
	 * allocate goal length but might trim the request if nothing
	 * is found after enough tries.
	 */
	CR_GOAL_LEN_SLOW,

	/*
	 * Finds the first free set of blocks and allocates
	 * those. This is only used in rare cases when
	 * CR_GOAL_LEN_SLOW also fails to allocate anything.
	 */
	CR_ANY_FREE,

	/*
	 * Number of criterias defined.
	 */
	EXT4_MB_NUM_CRS
};

/*
 * Flags used in mballoc's allocation_context flags field.
 *
 * Also used to show what's going on for debugging purposes when the
 * flag field is exported via the traceport interface
 */

/* prefer goal again. length */
#define EXT4_MB_HINT_MERGE		0x0001
/* first blocks in the file */
#define EXT4_MB_HINT_FIRST		0x0008
/* data is being allocated */
#define EXT4_MB_HINT_DATA		0x0020
/* don't preallocate (for tails) */
#define EXT4_MB_HINT_NOPREALLOC		0x0040
/* allocate for locality group */
#define EXT4_MB_HINT_GROUP_ALLOC	0x0080
/* allocate goal blocks or none */
#define EXT4_MB_HINT_GOAL_ONLY		0x0100
/* goal is meaningful */
#define EXT4_MB_HINT_TRY_GOAL		0x0200
/* blocks already pre-reserved by delayed allocation */
#define EXT4_MB_DELALLOC_RESERVED	0x0400
/* We are doing stream allocation */
#define EXT4_MB_STREAM_ALLOC		0x0800
/* Use reserved root blocks if needed */
#define EXT4_MB_USE_ROOT_BLOCKS		0x1000
/* Use blocks from reserved pool */
#define EXT4_MB_USE_RESERVED		0x2000
/* Do strict check for free blocks while retrying block allocation */
#define EXT4_MB_STRICT_CHECK		0x4000

struct ext4_allocation_request {
	/* target inode for block we're allocating */
	struct inode *inode;
	/* how many blocks we want to allocate */
	unsigned int len;
	/* logical block in target inode */
	ext4_lblk_t logical;
	/* the closest logical allocated block to the left */
	ext4_lblk_t lleft;
	/* the closest logical allocated block to the right */
	ext4_lblk_t lright;
	/* phys. target (a hint) */
	ext4_fsblk_t goal;
	/* phys. block for the closest logical allocated block to the left */
	ext4_fsblk_t pleft;
	/* phys. block for the closest logical allocated block to the right */
	ext4_fsblk_t pright;
	/* flags. see above EXT4_MB_HINT_* */
	unsigned int flags;
};

/*
 * Logical to physical block mapping, used by ext4_map_blocks()
 *
 * This structure is used to pass requests into ext4_map_blocks() as
 * well as to store the information returned by ext4_map_blocks().  It
 * takes less room on the stack than a struct buffer_head.
 */
#define EXT4_MAP_NEW		BIT(BH_New)
#define EXT4_MAP_MAPPED		BIT(BH_Mapped)
#define EXT4_MAP_UNWRITTEN	BIT(BH_Unwritten)
#define EXT4_MAP_BOUNDARY	BIT(BH_Boundary)
#define EXT4_MAP_DELAYED	BIT(BH_Delay)
/*
 * This is for use in ext4_map_query_blocks() for a special case where we can
 * have a physically and logically contiguous blocks split across two leaf
 * nodes instead of a single extent. This is required in case of atomic writes
 * to know whether the returned extent is last in leaf. If yes, then lookup for
 * next in leaf block in ext4_map_query_blocks_next_in_leaf().
 * - This is never going to be added to any buffer head state.
 * - We use the next available bit after BH_BITMAP_UPTODATE.
 */
#define EXT4_MAP_QUERY_LAST_IN_LEAF	BIT(BH_BITMAP_UPTODATE + 1)
#define EXT4_MAP_FLAGS		(EXT4_MAP_NEW | EXT4_MAP_MAPPED |\
				 EXT4_MAP_UNWRITTEN | EXT4_MAP_BOUNDARY |\
				 EXT4_MAP_DELAYED | EXT4_MAP_QUERY_LAST_IN_LEAF)

struct ext4_map_blocks {
	ext4_fsblk_t m_pblk;
	ext4_lblk_t m_lblk;
	unsigned int m_len;
	unsigned int m_flags;
};

/*
 * Block validity checking, system zone rbtree.
 */
struct ext4_system_blocks {
	struct rb_root root;
	struct rcu_head rcu;
};

/*
 * Flags for ext4_io_end->flags
 */
#define EXT4_IO_END_UNWRITTEN	0x0001
#define EXT4_IO_END_FAILED	0x0002

#define EXT4_IO_END_DEFER_COMPLETION (EXT4_IO_END_UNWRITTEN | EXT4_IO_END_FAILED)

struct ext4_io_end_vec {
	struct list_head list;		/* list of io_end_vec */
	loff_t offset;			/* offset in the file */
	ssize_t size;			/* size of the extent */
};

/*
 * For converting unwritten extents on a work queue. 'handle' is used for
 * buffered writeback.
 */
typedef struct ext4_io_end {
	struct list_head	list;		/* per-file finished IO list */
	handle_t		*handle;	/* handle reserved for extent
						 * conversion */
	struct inode		*inode;		/* file being written to */
	struct bio		*bio;		/* Linked list of completed
						 * bios covering the extent */
	unsigned int		flag;		/* unwritten or not */
	refcount_t		count;		/* reference counter */
	struct list_head	list_vec;	/* list of ext4_io_end_vec */
} ext4_io_end_t;

struct ext4_io_submit {
	struct writeback_control *io_wbc;
	struct bio		*io_bio;
	ext4_io_end_t		*io_end;
	sector_t		io_next_block;
};

/*
 * Special inodes numbers
 */
#define	EXT4_BAD_INO		 1	/* Bad blocks inode */
#define EXT4_ROOT_INO		 2	/* Root inode */
#define EXT4_USR_QUOTA_INO	 3	/* User quota inode */
#define EXT4_GRP_QUOTA_INO	 4	/* Group quota inode */
#define EXT4_BOOT_LOADER_INO	 5	/* Boot loader inode */
#define EXT4_UNDEL_DIR_INO	 6	/* Undelete directory inode */
#define EXT4_RESIZE_INO		 7	/* Reserved group descriptors inode */
#define EXT4_JOURNAL_INO	 8	/* Journal inode */

/* First non-reserved inode for old ext4 filesystems */
#define EXT4_GOOD_OLD_FIRST_INO	11

/*
 * Maximal count of links to a file
 */
#define EXT4_LINK_MAX		65000

/*
 * Macro-instructions used to manage several block sizes
 */
#define EXT4_MIN_BLOCK_SIZE		1024
#define	EXT4_MAX_BLOCK_SIZE		65536
#define EXT4_MIN_BLOCK_LOG_SIZE		10
#define EXT4_MAX_BLOCK_LOG_SIZE		16
#define EXT4_MAX_CLUSTER_LOG_SIZE	30
#ifdef __KERNEL__
# define EXT4_BLOCK_SIZE(s)		((s)->s_blocksize)
#else
# define EXT4_BLOCK_SIZE(s)		(EXT4_MIN_BLOCK_SIZE << (s)->s_log_block_size)
#endif
#define	EXT4_ADDR_PER_BLOCK(s)		(EXT4_BLOCK_SIZE(s) / sizeof(__u32))
#define EXT4_CLUSTER_SIZE(s)		(EXT4_BLOCK_SIZE(s) << \
					 EXT4_SB(s)->s_cluster_bits)
#ifdef __KERNEL__
# define EXT4_BLOCK_SIZE_BITS(s)	((s)->s_blocksize_bits)
# define EXT4_CLUSTER_BITS(s)		(EXT4_SB(s)->s_cluster_bits)
#else
# define EXT4_BLOCK_SIZE_BITS(s)	((s)->s_log_block_size + 10)
#endif
#ifdef __KERNEL__
#define	EXT4_ADDR_PER_BLOCK_BITS(s)	(EXT4_SB(s)->s_addr_per_block_bits)
#define EXT4_INODE_SIZE(s)		(EXT4_SB(s)->s_inode_size)
#define EXT4_FIRST_INO(s)		(EXT4_SB(s)->s_first_ino)
#else
#define EXT4_INODE_SIZE(s)	(((s)->s_rev_level == EXT4_GOOD_OLD_REV) ? \
				 EXT4_GOOD_OLD_INODE_SIZE : \
				 (s)->s_inode_size)
#define EXT4_FIRST_INO(s)	(((s)->s_rev_level == EXT4_GOOD_OLD_REV) ? \
				 EXT4_GOOD_OLD_FIRST_INO : \
				 (s)->s_first_ino)
#endif
#define EXT4_BLOCK_ALIGN(size, blkbits)		ALIGN((size), (1 << (blkbits)))
#define EXT4_MAX_BLOCKS(size, offset, blkbits) \
	((EXT4_BLOCK_ALIGN(size + offset, blkbits) >> blkbits) - (offset >> \
								  blkbits))
#define EXT4_B_TO_LBLK(inode, offset) \
	(round_up((offset), i_blocksize(inode)) >> (inode)->i_blkbits)

/* Translate a block number to a cluster number */
#define EXT4_B2C(sbi, blk)	((blk) >> (sbi)->s_cluster_bits)
/* Translate a cluster number to a block number */
#define EXT4_C2B(sbi, cluster)	((cluster) << (sbi)->s_cluster_bits)
/* Translate # of blks to # of clusters */
#define EXT4_NUM_B2C(sbi, blks)	(((blks) + (sbi)->s_cluster_ratio - 1) >> \
				 (sbi)->s_cluster_bits)
/* Mask out the low bits to get the starting block of the cluster */
#define EXT4_PBLK_CMASK(s, pblk) ((pblk) &				\
				  ~((ext4_fsblk_t) (s)->s_cluster_ratio - 1))
#define EXT4_LBLK_CMASK(s, lblk) ((lblk) &				\
				  ~((ext4_lblk_t) (s)->s_cluster_ratio - 1))
/* Fill in the low bits to get the last block of the cluster */
#define EXT4_LBLK_CFILL(sbi, lblk) ((lblk) |				\
				    ((ext4_lblk_t) (sbi)->s_cluster_ratio - 1))
/* Get the cluster offset */
#define EXT4_PBLK_COFF(s, pblk) ((pblk) &				\
				 ((ext4_fsblk_t) (s)->s_cluster_ratio - 1))
#define EXT4_LBLK_COFF(s, lblk) ((lblk) &				\
				 ((ext4_lblk_t) (s)->s_cluster_ratio - 1))

/*
 * Structure of a blocks group descriptor
 */
struct ext4_group_desc
{
	__le32	bg_block_bitmap_lo;	/* Blocks bitmap block */
	__le32	bg_inode_bitmap_lo;	/* Inodes bitmap block */
	__le32	bg_inode_table_lo;	/* Inodes table block */
	__le16	bg_free_blocks_count_lo;/* Free blocks count */
	__le16	bg_free_inodes_count_lo;/* Free inodes count */
	__le16	bg_used_dirs_count_lo;	/* Directories count */
	__le16	bg_flags;		/* EXT4_BG_flags (INODE_UNINIT, etc) */
	__le32  bg_exclude_bitmap_lo;   /* Exclude bitmap for snapshots */
	__le16  bg_block_bitmap_csum_lo;/* crc32c(s_uuid+grp_num+bbitmap) LE */
	__le16  bg_inode_bitmap_csum_lo;/* crc32c(s_uuid+grp_num+ibitmap) LE */
	__le16  bg_itable_unused_lo;	/* Unused inodes count */
	__le16  bg_checksum;		/* crc16(sb_uuid+group+desc) */
	__le32	bg_block_bitmap_hi;	/* Blocks bitmap block MSB */
	__le32	bg_inode_bitmap_hi;	/* Inodes bitmap block MSB */
	__le32	bg_inode_table_hi;	/* Inodes table block MSB */
	__le16	bg_free_blocks_count_hi;/* Free blocks count MSB */
	__le16	bg_free_inodes_count_hi;/* Free inodes count MSB */
	__le16	bg_used_dirs_count_hi;	/* Directories count MSB */
	__le16  bg_itable_unused_hi;    /* Unused inodes count MSB */
	__le32  bg_exclude_bitmap_hi;   /* Exclude bitmap block MSB */
	__le16  bg_block_bitmap_csum_hi;/* crc32c(s_uuid+grp_num+bbitmap) BE */
	__le16  bg_inode_bitmap_csum_hi;/* crc32c(s_uuid+grp_num+ibitmap) BE */
	__u32   bg_reserved;
};

#define EXT4_BG_INODE_BITMAP_CSUM_HI_END	\
	(offsetof(struct ext4_group_desc, bg_inode_bitmap_csum_hi) + \
	 sizeof(__le16))
#define EXT4_BG_BLOCK_BITMAP_CSUM_HI_END	\
	(offsetof(struct ext4_group_desc, bg_block_bitmap_csum_hi) + \
	 sizeof(__le16))

/*
 * Structure of a flex block group info
 */

struct flex_groups {
	atomic64_t	free_clusters;
	atomic_t	free_inodes;
	atomic_t	used_dirs;
};

#define EXT4_BG_INODE_UNINIT	0x0001 /* Inode table/bitmap not in use */
#define EXT4_BG_BLOCK_UNINIT	0x0002 /* Block bitmap not in use */
#define EXT4_BG_INODE_ZEROED	0x0004 /* On-disk itable initialized to zero */

/*
 * Macro-instructions used to manage group descriptors
 */
#define EXT4_MIN_DESC_SIZE		32
#define EXT4_MIN_DESC_SIZE_64BIT	64
#define	EXT4_MAX_DESC_SIZE		EXT4_MIN_BLOCK_SIZE
#define EXT4_DESC_SIZE(s)		(EXT4_SB(s)->s_desc_size)
#ifdef __KERNEL__
# define EXT4_BLOCKS_PER_GROUP(s)	(EXT4_SB(s)->s_blocks_per_group)
# define EXT4_CLUSTERS_PER_GROUP(s)	(EXT4_SB(s)->s_clusters_per_group)
# define EXT4_DESC_PER_BLOCK(s)		(EXT4_SB(s)->s_desc_per_block)
# define EXT4_INODES_PER_GROUP(s)	(EXT4_SB(s)->s_inodes_per_group)
# define EXT4_DESC_PER_BLOCK_BITS(s)	(EXT4_SB(s)->s_desc_per_block_bits)
#else
# define EXT4_BLOCKS_PER_GROUP(s)	((s)->s_blocks_per_group)
# define EXT4_DESC_PER_BLOCK(s)		(EXT4_BLOCK_SIZE(s) / EXT4_DESC_SIZE(s))
# define EXT4_INODES_PER_GROUP(s)	((s)->s_inodes_per_group)
#endif

/*
 * Constants relative to the data blocks
 */
#define	EXT4_NDIR_BLOCKS		12
#define	EXT4_IND_BLOCK			EXT4_NDIR_BLOCKS
#define	EXT4_DIND_BLOCK			(EXT4_IND_BLOCK + 1)
#define	EXT4_TIND_BLOCK			(EXT4_DIND_BLOCK + 1)
#define	EXT4_N_BLOCKS			(EXT4_TIND_BLOCK + 1)

/*
 * Inode flags
 */
#define	EXT4_SECRM_FL			0x00000001 /* Secure deletion */
#define	EXT4_UNRM_FL			0x00000002 /* Undelete */
#define	EXT4_COMPR_FL			0x00000004 /* Compress file */
#define EXT4_SYNC_FL			0x00000008 /* Synchronous updates */
#define EXT4_IMMUTABLE_FL		0x00000010 /* Immutable file */
#define EXT4_APPEND_FL			0x00000020 /* writes to file may only append */
#define EXT4_NODUMP_FL			0x00000040 /* do not dump file */
#define EXT4_NOATIME_FL			0x00000080 /* do not update atime */
/* Reserved for compression usage... */
#define EXT4_DIRTY_FL			0x00000100
#define EXT4_COMPRBLK_FL		0x00000200 /* One or more compressed clusters */
#define EXT4_NOCOMPR_FL			0x00000400 /* Don't compress */
	/* nb: was previously EXT2_ECOMPR_FL */
#define EXT4_ENCRYPT_FL			0x00000800 /* encrypted file */
/* End compression flags --- maybe not all used */
#define EXT4_INDEX_FL			0x00001000 /* hash-indexed directory */
#define EXT4_IMAGIC_FL			0x00002000 /* AFS directory */
#define EXT4_JOURNAL_DATA_FL		0x00004000 /* file data should be journaled */
#define EXT4_NOTAIL_FL			0x00008000 /* file tail should not be merged */
#define EXT4_DIRSYNC_FL			0x00010000 /* dirsync behaviour (directories only) */
#define EXT4_TOPDIR_FL			0x00020000 /* Top of directory hierarchies*/
#define EXT4_HUGE_FILE_FL               0x00040000 /* Set to each huge file */
#define EXT4_EXTENTS_FL			0x00080000 /* Inode uses extents */
#define EXT4_VERITY_FL			0x00100000 /* Verity protected inode */
#define EXT4_EA_INODE_FL	        0x00200000 /* Inode used for large EA */
/* 0x00400000 was formerly EXT4_EOFBLOCKS_FL */

#define EXT4_DAX_FL			0x02000000 /* Inode is DAX */

#define EXT4_INLINE_DATA_FL		0x10000000 /* Inode has inline data. */
#define EXT4_PROJINHERIT_FL		0x20000000 /* Create with parents projid */
#define EXT4_CASEFOLD_FL		0x40000000 /* Casefolded directory */
#define EXT4_RESERVED_FL		0x80000000 /* reserved for ext4 lib */

/* User modifiable flags */
#define EXT4_FL_USER_MODIFIABLE		(EXT4_SECRM_FL | \
					 EXT4_UNRM_FL | \
					 EXT4_COMPR_FL | \
					 EXT4_SYNC_FL | \
					 EXT4_IMMUTABLE_FL | \
					 EXT4_APPEND_FL | \
					 EXT4_NODUMP_FL | \
					 EXT4_NOATIME_FL | \
					 EXT4_JOURNAL_DATA_FL | \
					 EXT4_NOTAIL_FL | \
					 EXT4_DIRSYNC_FL | \
					 EXT4_TOPDIR_FL | \
					 EXT4_EXTENTS_FL | \
					 0x00400000 /* EXT4_EOFBLOCKS_FL */ | \
					 EXT4_DAX_FL | \
					 EXT4_PROJINHERIT_FL | \
					 EXT4_CASEFOLD_FL)

/* User visible flags */
#define EXT4_FL_USER_VISIBLE		(EXT4_FL_USER_MODIFIABLE | \
					 EXT4_DIRTY_FL | \
					 EXT4_COMPRBLK_FL | \
					 EXT4_NOCOMPR_FL | \
					 EXT4_ENCRYPT_FL | \
					 EXT4_INDEX_FL | \
					 EXT4_VERITY_FL | \
					 EXT4_INLINE_DATA_FL)

/* Flags that should be inherited by new inodes from their parent. */
#define EXT4_FL_INHERITED (EXT4_SECRM_FL | EXT4_UNRM_FL | EXT4_COMPR_FL |\
			   EXT4_SYNC_FL | EXT4_NODUMP_FL | EXT4_NOATIME_FL |\
			   EXT4_NOCOMPR_FL | EXT4_JOURNAL_DATA_FL |\
			   EXT4_NOTAIL_FL | EXT4_DIRSYNC_FL |\
			   EXT4_PROJINHERIT_FL | EXT4_CASEFOLD_FL |\
			   EXT4_DAX_FL)

/* Flags that are appropriate for regular files (all but dir-specific ones). */
#define EXT4_REG_FLMASK (~(EXT4_DIRSYNC_FL | EXT4_TOPDIR_FL | EXT4_CASEFOLD_FL |\
			   EXT4_PROJINHERIT_FL))

/* Flags that are appropriate for non-directories/regular files. */
#define EXT4_OTHER_FLMASK (EXT4_NODUMP_FL | EXT4_NOATIME_FL)

/* The only flags that should be swapped */
#define EXT4_FL_SHOULD_SWAP (EXT4_HUGE_FILE_FL | EXT4_EXTENTS_FL)

/* Flags which are mutually exclusive to DAX */
#define EXT4_DAX_MUT_EXCL (EXT4_VERITY_FL | EXT4_ENCRYPT_FL |\
			   EXT4_JOURNAL_DATA_FL | EXT4_INLINE_DATA_FL)

/* Mask out flags that are inappropriate for the given type of inode. */
static inline __u32 ext4_mask_flags(umode_t mode, __u32 flags)
{
	if (S_ISDIR(mode))
		return flags;
	else if (S_ISREG(mode))
		return flags & EXT4_REG_FLMASK;
	else
		return flags & EXT4_OTHER_FLMASK;
}

/*
 * Inode flags used for atomic set/get
 */
enum {
	EXT4_INODE_SECRM	= 0,	/* Secure deletion */
	EXT4_INODE_UNRM		= 1,	/* Undelete */
	EXT4_INODE_COMPR	= 2,	/* Compress file */
	EXT4_INODE_SYNC		= 3,	/* Synchronous updates */
	EXT4_INODE_IMMUTABLE	= 4,	/* Immutable file */
	EXT4_INODE_APPEND	= 5,	/* writes to file may only append */
	EXT4_INODE_NODUMP	= 6,	/* do not dump file */
	EXT4_INODE_NOATIME	= 7,	/* do not update atime */
/* Reserved for compression usage... */
	EXT4_INODE_DIRTY	= 8,
	EXT4_INODE_COMPRBLK	= 9,	/* One or more compressed clusters */
	EXT4_INODE_NOCOMPR	= 10,	/* Don't compress */
	EXT4_INODE_ENCRYPT	= 11,	/* Encrypted file */
/* End compression flags --- maybe not all used */
	EXT4_INODE_INDEX	= 12,	/* hash-indexed directory */
	EXT4_INODE_IMAGIC	= 13,	/* AFS directory */
	EXT4_INODE_JOURNAL_DATA	= 14,	/* file data should be journaled */
	EXT4_INODE_NOTAIL	= 15,	/* file tail should not be merged */
	EXT4_INODE_DIRSYNC	= 16,	/* dirsync behaviour (directories only) */
	EXT4_INODE_TOPDIR	= 17,	/* Top of directory hierarchies*/
	EXT4_INODE_HUGE_FILE	= 18,	/* Set to each huge file */
	EXT4_INODE_EXTENTS	= 19,	/* Inode uses extents */
	EXT4_INODE_VERITY	= 20,	/* Verity protected inode */
	EXT4_INODE_EA_INODE	= 21,	/* Inode used for large EA */
/* 22 was formerly EXT4_INODE_EOFBLOCKS */
	EXT4_INODE_DAX		= 25,	/* Inode is DAX */
	EXT4_INODE_INLINE_DATA	= 28,	/* Data in inode. */
	EXT4_INODE_PROJINHERIT	= 29,	/* Create with parents projid */
	EXT4_INODE_CASEFOLD	= 30,	/* Casefolded directory */
	EXT4_INODE_RESERVED	= 31,	/* reserved for ext4 lib */
};

/*
 * Since it's pretty easy to mix up bit numbers and hex values, we use a
 * build-time check to make sure that EXT4_XXX_FL is consistent with respect to
 * EXT4_INODE_XXX. If all is well, the macros will be dropped, so, it won't cost
 * any extra space in the compiled kernel image, otherwise, the build will fail.
 * It's important that these values are the same, since we are using
 * EXT4_INODE_XXX to test for flag values, but EXT4_XXX_FL must be consistent
 * with the values of FS_XXX_FL defined in include/linux/fs.h and the on-disk
 * values found in ext2, ext3 and ext4 filesystems, and of course the values
 * defined in e2fsprogs.
 *
 * It's not paranoia if the Murphy's Law really *is* out to get you.  :-)
 */
#define TEST_FLAG_VALUE(FLAG) (EXT4_##FLAG##_FL == (1U << EXT4_INODE_##FLAG))
#define CHECK_FLAG_VALUE(FLAG) BUILD_BUG_ON(!TEST_FLAG_VALUE(FLAG))

static inline void ext4_check_flag_values(void)
{
	CHECK_FLAG_VALUE(SECRM);
	CHECK_FLAG_VALUE(UNRM);
	CHECK_FLAG_VALUE(COMPR);
	CHECK_FLAG_VALUE(SYNC);
	CHECK_FLAG_VALUE(IMMUTABLE);
	CHECK_FLAG_VALUE(APPEND);
	CHECK_FLAG_VALUE(NODUMP);
	CHECK_FLAG_VALUE(NOATIME);
	CHECK_FLAG_VALUE(DIRTY);
	CHECK_FLAG_VALUE(COMPRBLK);
	CHECK_FLAG_VALUE(NOCOMPR);
	CHECK_FLAG_VALUE(ENCRYPT);
	CHECK_FLAG_VALUE(INDEX);
	CHECK_FLAG_VALUE(IMAGIC);
	CHECK_FLAG_VALUE(JOURNAL_DATA);
	CHECK_FLAG_VALUE(NOTAIL);
	CHECK_FLAG_VALUE(DIRSYNC);
	CHECK_FLAG_VALUE(TOPDIR);
	CHECK_FLAG_VALUE(HUGE_FILE);
	CHECK_FLAG_VALUE(EXTENTS);
	CHECK_FLAG_VALUE(VERITY);
	CHECK_FLAG_VALUE(EA_INODE);
	CHECK_FLAG_VALUE(INLINE_DATA);
	CHECK_FLAG_VALUE(PROJINHERIT);
	CHECK_FLAG_VALUE(CASEFOLD);
	CHECK_FLAG_VALUE(RESERVED);
}

#if defined(__KERNEL__) && defined(CONFIG_COMPAT)
struct compat_ext4_new_group_input {
	u32 group;
	compat_u64 block_bitmap;
	compat_u64 inode_bitmap;
	compat_u64 inode_table;
	u32 blocks_count;
	u16 reserved_blocks;
	u16 unused;
};
#endif

/* The struct ext4_new_group_input in kernel space, with free_blocks_count */
struct ext4_new_group_data {
	__u32 group;
	__u64 block_bitmap;
	__u64 inode_bitmap;
	__u64 inode_table;
	__u32 blocks_count;
	__u16 reserved_blocks;
	__u16 mdata_blocks;
	__u32 free_clusters_count;
};

/* Indexes used to index group tables in ext4_new_group_data */
enum {
	BLOCK_BITMAP = 0,	/* block bitmap */
	INODE_BITMAP,		/* inode bitmap */
	INODE_TABLE,		/* inode tables */
	GROUP_TABLE_COUNT,
};

/*
 * Flags used by ext4_map_blocks()
 */
	/* Allocate any needed blocks and/or convert an unwritten
	   extent to be an initialized ext4 */
#define EXT4_GET_BLOCKS_CREATE			0x0001
	/* Request the creation of an unwritten extent */
#define EXT4_GET_BLOCKS_UNWRIT_EXT		0x0002
#define EXT4_GET_BLOCKS_CREATE_UNWRIT_EXT	(EXT4_GET_BLOCKS_UNWRIT_EXT|\
						 EXT4_GET_BLOCKS_CREATE)
	/* Caller is from the delayed allocation writeout path
	 * finally doing the actual allocation of delayed blocks */
#define EXT4_GET_BLOCKS_DELALLOC_RESERVE	0x0004
	/* caller is from the direct IO path, request to creation of an
	unwritten extents if not allocated, split the unwritten
	extent if blocks has been preallocated already*/
#define EXT4_GET_BLOCKS_PRE_IO			0x0008
#define EXT4_GET_BLOCKS_CONVERT			0x0010
#define EXT4_GET_BLOCKS_IO_CREATE_EXT		(EXT4_GET_BLOCKS_PRE_IO|\
					 EXT4_GET_BLOCKS_CREATE_UNWRIT_EXT)
	/* Eventual metadata allocation (due to growing extent tree)
	 * should not fail, so try to use reserved blocks for that.*/
#define EXT4_GET_BLOCKS_METADATA_NOFAIL		0x0020
	/* Don't normalize allocation size (used for fallocate) */
#define EXT4_GET_BLOCKS_NO_NORMALIZE		0x0040
	/* Convert written extents to unwritten */
#define EXT4_GET_BLOCKS_CONVERT_UNWRITTEN	0x0100
	/* Write zeros to newly created written extents */
#define EXT4_GET_BLOCKS_ZERO			0x0200
#define EXT4_GET_BLOCKS_CREATE_ZERO		(EXT4_GET_BLOCKS_CREATE |\
					EXT4_GET_BLOCKS_ZERO)
	/* Caller is in the context of data submission, such as writeback,
	 * fsync, etc. Especially, in the generic writeback path, caller will
	 * submit data before dropping transaction handle. This allows jbd2
	 * to avoid submitting data before commit. */
#define EXT4_GET_BLOCKS_IO_SUBMIT		0x0400
	/* Convert extent to initialized after IO complete */
#define EXT4_GET_BLOCKS_IO_CONVERT_EXT		(EXT4_GET_BLOCKS_CONVERT |\
					 EXT4_GET_BLOCKS_CREATE_UNWRIT_EXT |\
					 EXT4_GET_BLOCKS_IO_SUBMIT)
	/* Caller is in the atomic contex, find extent if it has been cached */
#define EXT4_GET_BLOCKS_CACHED_NOWAIT		0x0800
/*
 * Atomic write caller needs this to query in the slow path of mixed mapping
 * case, when a contiguous extent can be split across two adjacent leaf nodes.
 * Look EXT4_MAP_QUERY_LAST_IN_LEAF.
 */
#define EXT4_GET_BLOCKS_QUERY_LAST_IN_LEAF	0x1000

/*
 * The bit position of these flags must not overlap with any of the
 * EXT4_GET_BLOCKS_*.  They are used by ext4_find_extent(),
 * read_extent_tree_block(), ext4_split_extent_at(),
 * ext4_ext_insert_extent(), and ext4_ext_create_new_leaf().
 * EXT4_EX_NOCACHE is used to indicate that the we shouldn't be
 * caching the extents when reading from the extent tree while a
 * truncate or punch hole operation is in progress.
 */
#define EXT4_EX_NOCACHE				0x40000000
#define EXT4_EX_FORCE_CACHE			0x20000000
#define EXT4_EX_NOFAIL				0x10000000
/*
 * ext4_map_query_blocks() uses this filter mask to filter the flags needed to
 * pass while lookup/querying of on disk extent tree.
 */
#define EXT4_EX_QUERY_FILTER	(EXT4_EX_NOCACHE | EXT4_EX_FORCE_CACHE |\
				 EXT4_EX_NOFAIL |\
				 EXT4_GET_BLOCKS_QUERY_LAST_IN_LEAF)

/*
 * Flags used by ext4_free_blocks
 */
#define EXT4_FREE_BLOCKS_METADATA		0x0001
#define EXT4_FREE_BLOCKS_FORGET			0x0002
#define EXT4_FREE_BLOCKS_VALIDATED		0x0004
#define EXT4_FREE_BLOCKS_NO_QUOT_UPDATE		0x0008
#define EXT4_FREE_BLOCKS_NOFREE_FIRST_CLUSTER	0x0010
#define EXT4_FREE_BLOCKS_NOFREE_LAST_CLUSTER	0x0020
#define EXT4_FREE_BLOCKS_RERESERVE_CLUSTER      0x0040

#if defined(__KERNEL__) && defined(CONFIG_COMPAT)
/*
 * ioctl commands in 32 bit emulation
 */
#define EXT4_IOC32_GETVERSION		_IOR('f', 3, int)
#define EXT4_IOC32_SETVERSION		_IOW('f', 4, int)
#define EXT4_IOC32_GETRSVSZ		_IOR('f', 5, int)
#define EXT4_IOC32_SETRSVSZ		_IOW('f', 6, int)
#define EXT4_IOC32_GROUP_EXTEND		_IOW('f', 7, unsigned int)
#define EXT4_IOC32_GROUP_ADD		_IOW('f', 8, struct compat_ext4_new_group_input)
#define EXT4_IOC32_GETVERSION_OLD	FS_IOC32_GETVERSION
#define EXT4_IOC32_SETVERSION_OLD	FS_IOC32_SETVERSION
#endif

/* Max physical block we can address w/o extents */
#define EXT4_MAX_BLOCK_FILE_PHYS	0xFFFFFFFF

/* Max logical block we can support */
#define EXT4_MAX_LOGICAL_BLOCK		0xFFFFFFFE

/*
 * Structure of an inode on the disk
 */
struct ext4_inode {
	__le16	i_mode;		/* File mode */
	__le16	i_uid;		/* Low 16 bits of Owner Uid */
	__le32	i_size_lo;	/* Size in bytes */
	__le32	i_atime;	/* Access time */
	__le32	i_ctime;	/* Inode Change time */
	__le32	i_mtime;	/* Modification time */
	__le32	i_dtime;	/* Deletion Time */
	__le16	i_gid;		/* Low 16 bits of Group Id */
	__le16	i_links_count;	/* Links count */
	__le32	i_blocks_lo;	/* Blocks count */
	__le32	i_flags;	/* File flags */
	union {
		struct {
			__le32  l_i_version;
		} linux1;
		struct {
			__u32  h_i_translator;
		} hurd1;
		struct {
			__u32  m_i_reserved1;
		} masix1;
	} osd1;				/* OS dependent 1 */
	__le32	i_block[EXT4_N_BLOCKS];/* Pointers to blocks */
	__le32	i_generation;	/* File version (for NFS) */
	__le32	i_file_acl_lo;	/* File ACL */
	__le32	i_size_high;
	__le32	i_obso_faddr;	/* Obsoleted fragment address */
	union {
		struct {
			__le16	l_i_blocks_high; /* were l_i_reserved1 */
			__le16	l_i_file_acl_high;
			__le16	l_i_uid_high;	/* these 2 fields */
			__le16	l_i_gid_high;	/* were reserved2[0] */
			__le16	l_i_checksum_lo;/* crc32c(uuid+inum+inode) LE */
			__le16	l_i_reserved;
		} linux2;
		struct {
			__le16	h_i_reserved1;	/* Obsoleted fragment number/size which are removed in ext4 */
			__u16	h_i_mode_high;
			__u16	h_i_uid_high;
			__u16	h_i_gid_high;
			__u32	h_i_author;
		} hurd2;
		struct {
			__le16	h_i_reserved1;	/* Obsoleted fragment number/size which are removed in ext4 */
			__le16	m_i_file_acl_high;
			__u32	m_i_reserved2[2];
		} masix2;
	} osd2;				/* OS dependent 2 */
	__le16	i_extra_isize;
	__le16	i_checksum_hi;	/* crc32c(uuid+inum+inode) BE */
	__le32  i_ctime_extra;  /* extra Change time      (nsec << 2 | epoch) */
	__le32  i_mtime_extra;  /* extra Modification time(nsec << 2 | epoch) */
	__le32  i_atime_extra;  /* extra Access time      (nsec << 2 | epoch) */
	__le32  i_crtime;       /* File Creation time */
	__le32  i_crtime_extra; /* extra FileCreationtime (nsec << 2 | epoch) */
	__le32  i_version_hi;	/* high 32 bits for 64-bit version */
	__le32	i_projid;	/* Project ID */
};

#define EXT4_EPOCH_BITS 2
#define EXT4_EPOCH_MASK ((1 << EXT4_EPOCH_BITS) - 1)
#define EXT4_NSEC_MASK  (~0UL << EXT4_EPOCH_BITS)

/*
 * Extended fields will fit into an inode if the filesystem was formatted
 * with large inodes (-I 256 or larger) and there are not currently any EAs
 * consuming all of the available space. For new inodes we always reserve
 * enough space for the kernel's known extended fields, but for inodes
 * created with an old kernel this might not have been the case. None of
 * the extended inode fields is critical for correct filesystem operation.
 * This macro checks if a certain field fits in the inode. Note that
 * inode-size = GOOD_OLD_INODE_SIZE + i_extra_isize
 */
#define EXT4_FITS_IN_INODE(ext4_inode, einode, field)	\
	((offsetof(typeof(*ext4_inode), field) +	\
	  sizeof((ext4_inode)->field))			\
	<= (EXT4_GOOD_OLD_INODE_SIZE +			\
	    (einode)->i_extra_isize))			\

/*
 * We use an encoding that preserves the times for extra epoch "00":
 *
 * extra  msb of                         adjust for signed
 * epoch  32-bit                         32-bit tv_sec to
 * bits   time    decoded 64-bit tv_sec  64-bit tv_sec      valid time range
 * 0 0    1    -0x80000000..-0x00000001  0x000000000 1901-12-13..1969-12-31
 * 0 0    0    0x000000000..0x07fffffff  0x000000000 1970-01-01..2038-01-19
 * 0 1    1    0x080000000..0x0ffffffff  0x100000000 2038-01-19..2106-02-07
 * 0 1    0    0x100000000..0x17fffffff  0x100000000 2106-02-07..2174-02-25
 * 1 0    1    0x180000000..0x1ffffffff  0x200000000 2174-02-25..2242-03-16
 * 1 0    0    0x200000000..0x27fffffff  0x200000000 2242-03-16..2310-04-04
 * 1 1    1    0x280000000..0x2ffffffff  0x300000000 2310-04-04..2378-04-22
 * 1 1    0    0x300000000..0x37fffffff  0x300000000 2378-04-22..2446-05-10
 *
 * Note that previous versions of the kernel on 64-bit systems would
 * incorrectly use extra epoch bits 1,1 for dates between 1901 and
 * 1970.  e2fsck will correct this, assuming that it is run on the
 * affected filesystem before 2242.
 */

static inline __le32 ext4_encode_extra_time(struct timespec64 ts)
{
	u32 extra = ((ts.tv_sec - (s32)ts.tv_sec) >> 32) & EXT4_EPOCH_MASK;
	return cpu_to_le32(extra | (ts.tv_nsec << EXT4_EPOCH_BITS));
}

static inline struct timespec64 ext4_decode_extra_time(__le32 base,
						       __le32 extra)
{
	struct timespec64 ts = { .tv_sec = (signed)le32_to_cpu(base) };

	if (unlikely(extra & cpu_to_le32(EXT4_EPOCH_MASK)))
		ts.tv_sec += (u64)(le32_to_cpu(extra) & EXT4_EPOCH_MASK) << 32;
	ts.tv_nsec = (le32_to_cpu(extra) & EXT4_NSEC_MASK) >> EXT4_EPOCH_BITS;
	return ts;
}

#define EXT4_INODE_SET_XTIME_VAL(xtime, inode, raw_inode, ts)			\
do {										\
	if (EXT4_FITS_IN_INODE(raw_inode, EXT4_I(inode), xtime ## _extra)) {	\
		(raw_inode)->xtime = cpu_to_le32((ts).tv_sec);			\
		(raw_inode)->xtime ## _extra = ext4_encode_extra_time(ts);	\
	} else									\
		(raw_inode)->xtime = cpu_to_le32(clamp_t(int32_t, (ts).tv_sec, S32_MIN, S32_MAX));	\
} while (0)

#define EXT4_INODE_SET_ATIME(inode, raw_inode)						\
	EXT4_INODE_SET_XTIME_VAL(i_atime, inode, raw_inode, inode_get_atime(inode))

#define EXT4_INODE_SET_MTIME(inode, raw_inode)						\
	EXT4_INODE_SET_XTIME_VAL(i_mtime, inode, raw_inode, inode_get_mtime(inode))

#define EXT4_INODE_SET_CTIME(inode, raw_inode)						\
	EXT4_INODE_SET_XTIME_VAL(i_ctime, inode, raw_inode, inode_get_ctime(inode))

#define EXT4_EINODE_SET_XTIME(xtime, einode, raw_inode)				\
	if (EXT4_FITS_IN_INODE(raw_inode, einode, xtime))			\
		EXT4_INODE_SET_XTIME_VAL(xtime, &((einode)->vfs_inode),		\
					 raw_inode, (einode)->xtime)

#define EXT4_INODE_GET_XTIME_VAL(xtime, inode, raw_inode)			\
	(EXT4_FITS_IN_INODE(raw_inode, EXT4_I(inode), xtime ## _extra) ?	\
		ext4_decode_extra_time((raw_inode)->xtime,				\
				       (raw_inode)->xtime ## _extra) :		\
		(struct timespec64) {						\
			.tv_sec = (signed)le32_to_cpu((raw_inode)->xtime)	\
		})

#define EXT4_INODE_GET_ATIME(inode, raw_inode)					\
do {										\
	inode_set_atime_to_ts(inode,						\
		EXT4_INODE_GET_XTIME_VAL(i_atime, inode, raw_inode));		\
} while (0)

#define EXT4_INODE_GET_MTIME(inode, raw_inode)					\
do {										\
	inode_set_mtime_to_ts(inode,						\
		EXT4_INODE_GET_XTIME_VAL(i_mtime, inode, raw_inode));		\
} while (0)

#define EXT4_INODE_GET_CTIME(inode, raw_inode)					\
do {										\
	inode_set_ctime_to_ts(inode,						\
		EXT4_INODE_GET_XTIME_VAL(i_ctime, inode, raw_inode));		\
} while (0)

#define EXT4_EINODE_GET_XTIME(xtime, einode, raw_inode)				\
do {										\
	if (EXT4_FITS_IN_INODE(raw_inode, einode, xtime)) 			\
		(einode)->xtime =						\
			EXT4_INODE_GET_XTIME_VAL(xtime, &(einode->vfs_inode),	\
						 raw_inode);			\
	else									\
		(einode)->xtime = (struct timespec64){0, 0};			\
} while (0)

#define i_disk_version osd1.linux1.l_i_version

#if defined(__KERNEL__) || defined(__linux__)
#define i_reserved1	osd1.linux1.l_i_reserved1
#define i_file_acl_high	osd2.linux2.l_i_file_acl_high
#define i_blocks_high	osd2.linux2.l_i_blocks_high
#define i_uid_low	i_uid
#define i_gid_low	i_gid
#define i_uid_high	osd2.linux2.l_i_uid_high
#define i_gid_high	osd2.linux2.l_i_gid_high
#define i_checksum_lo	osd2.linux2.l_i_checksum_lo

#elif defined(__GNU__)

#define i_translator	osd1.hurd1.h_i_translator
#define i_uid_high	osd2.hurd2.h_i_uid_high
#define i_gid_high	osd2.hurd2.h_i_gid_high
#define i_author	osd2.hurd2.h_i_author

#elif defined(__masix__)

#define i_reserved1	osd1.masix1.m_i_reserved1
#define i_file_acl_high	osd2.masix2.m_i_file_acl_high
#define i_reserved2	osd2.masix2.m_i_reserved2

#endif /* defined(__KERNEL__) || defined(__linux__) */

#include "extents_status.h"
#include "fast_commit.h"

/*
 * Lock subclasses for i_data_sem in the ext4_inode_info structure.
 *
 * These are needed to avoid lockdep false positives when we need to
 * allocate blocks to the quota inode during ext4_map_blocks(), while
 * holding i_data_sem for a normal (non-quota) inode.  Since we don't
 * do quota tracking for the quota inode, this avoids deadlock (as
 * well as infinite recursion, since it isn't turtles all the way
 * down...)
 *
 *  I_DATA_SEM_NORMAL - Used for most inodes
 *  I_DATA_SEM_OTHER  - Used by move_inode.c for the second normal inode
 *			  where the second inode has larger inode number
 *			  than the first
 *  I_DATA_SEM_QUOTA  - Used for quota inodes only
 *  I_DATA_SEM_EA     - Used for ea_inodes only
 */
enum {
	I_DATA_SEM_NORMAL = 0,
	I_DATA_SEM_OTHER,
	I_DATA_SEM_QUOTA,
	I_DATA_SEM_EA
};


/*
 * fourth extended file system inode data in memory
 */
struct ext4_inode_info {
	__le32	i_data[15];	/* unconverted */
	__u32	i_dtime;
	ext4_fsblk_t	i_file_acl;

	/*
	 * i_block_group is the number of the block group which contains
	 * this file's inode.  Constant across the lifetime of the inode,
	 * it is used for making block allocation decisions - we try to
	 * place a file's data blocks near its inode block, and new inodes
	 * near to their parent directory's inode.
	 */
	ext4_group_t	i_block_group;
	ext4_lblk_t	i_dir_start_lookup;
#if (BITS_PER_LONG < 64)
	unsigned long	i_state_flags;		/* Dynamic state flags */
#endif
	unsigned long	i_flags;

	/*
	 * Extended attributes can be read independently of the main file
	 * data. Taking i_rwsem even when reading would cause contention
	 * between readers of EAs and writers of regular file data, so
	 * instead we synchronize on xattr_sem when reading or changing
	 * EAs.
	 */
	struct rw_semaphore xattr_sem;

	/*
	 * Inodes with EXT4_STATE_ORPHAN_FILE use i_orphan_idx. Otherwise
	 * i_orphan is used.
	 */
	union {
		struct list_head i_orphan;	/* unlinked but open inodes */
		unsigned int i_orphan_idx;	/* Index in orphan file */
	};

	/* Fast commit related info */

	/* For tracking dentry create updates */
	struct list_head i_fc_dilist;
	struct list_head i_fc_list;	/*
					 * inodes that need fast commit
					 * protected by sbi->s_fc_lock.
					 */

	/* Start of lblk range that needs to be committed in this fast commit */
	ext4_lblk_t i_fc_lblk_start;

	/* End of lblk range that needs to be committed in this fast commit */
	ext4_lblk_t i_fc_lblk_len;

	spinlock_t i_raw_lock;	/* protects updates to the raw inode */

	/* Fast commit wait queue for this inode */
	wait_queue_head_t i_fc_wait;

	/*
	 * Protect concurrent accesses on i_fc_lblk_start, i_fc_lblk_len
	 * and inode's EXT4_FC_STATE_COMMITTING state bit.
	 */
	spinlock_t i_fc_lock;

	/*
	 * i_disksize keeps track of what the inode size is ON DISK, not
	 * in memory.  During truncate, i_size is set to the new size by
	 * the VFS prior to calling ext4_truncate(), but the filesystem won't
	 * set i_disksize to 0 until the truncate is actually under way.
	 *
	 * The intent is that i_disksize always represents the blocks which
	 * are used by this file.  This allows recovery to restart truncate
	 * on orphans if we crash during truncate.  We actually write i_disksize
	 * into the on-disk inode when writing inodes out, instead of i_size.
	 *
	 * The only time when i_disksize and i_size may be different is when
	 * a truncate is in progress.  The only things which change i_disksize
	 * are ext4_get_block (growth) and ext4_truncate (shrinkth).
	 */
	loff_t	i_disksize;

	/*
	 * i_data_sem is for serialising ext4_truncate() against
	 * ext4_getblock().  In the 2.4 ext2 design, great chunks of inode's
	 * data tree are chopped off during truncate. We can't do that in
	 * ext4 because whenever we perform intermediate commits during
	 * truncate, the inode and all the metadata blocks *must* be in a
	 * consistent state which allows truncation of the orphans to restart
	 * during recovery.  Hence we must fix the get_block-vs-truncate race
	 * by other means, so we have i_data_sem.
	 */
	struct rw_semaphore i_data_sem;
	struct inode vfs_inode;
	struct jbd2_inode *jinode;

	/*
	 * File creation time. Its function is same as that of
	 * struct timespec64 i_{a,c,m}time in the generic inode.
	 */
	struct timespec64 i_crtime;

	/* mballoc */
	atomic_t i_prealloc_active;

	/* allocation reservation info for delalloc */
	/* In case of bigalloc, this refer to clusters rather than blocks */
	unsigned int i_reserved_data_blocks;
	struct rb_root i_prealloc_node;
	rwlock_t i_prealloc_lock;

	/* extents status tree */
	struct ext4_es_tree i_es_tree;
	rwlock_t i_es_lock;
	struct list_head i_es_list;
	unsigned int i_es_all_nr;	/* protected by i_es_lock */
	unsigned int i_es_shk_nr;	/* protected by i_es_lock */
	ext4_lblk_t i_es_shrink_lblk;	/* Offset where we start searching for
					   extents to shrink. Protected by
					   i_es_lock  */

	/* ialloc */
	ext4_group_t	i_last_alloc_group;

	/* pending cluster reservations for bigalloc file systems */
	struct ext4_pending_tree i_pending_tree;

	/* on-disk additional length */
	__u16 i_extra_isize;

	/* Indicate the inline data space. */
	u16 i_inline_off;
	u16 i_inline_size;

#ifdef CONFIG_QUOTA
	/* quota space reservation, managed internally by quota code */
	qsize_t i_reserved_quota;
#endif
	spinlock_t i_block_reservation_lock;

	/* Lock protecting lists below */
	spinlock_t i_completed_io_lock;
	/*
	 * Completed IOs that need unwritten extents handling and have
	 * transaction reserved
	 */
	struct list_head i_rsv_conversion_list;
	struct work_struct i_rsv_conversion_work;

	/*
	 * Transactions that contain inode's metadata needed to complete
	 * fsync and fdatasync, respectively.
	 */
	tid_t i_sync_tid;
	tid_t i_datasync_tid;

#ifdef CONFIG_QUOTA
	struct dquot __rcu *i_dquot[MAXQUOTAS];
#endif

	/* Precomputed uuid+inum+igen checksum for seeding inode checksums */
	__u32 i_csum_seed;

	kprojid_t i_projid;
};

/*
 * File system states
 */
#define	EXT4_VALID_FS			0x0001	/* Unmounted cleanly */
#define	EXT4_ERROR_FS			0x0002	/* Errors detected */
#define	EXT4_ORPHAN_FS			0x0004	/* Orphans being recovered */
#define EXT4_FC_REPLAY			0x0020	/* Fast commit replay ongoing */

/*
 * Misc. filesystem flags
 */
#define EXT2_FLAGS_SIGNED_HASH		0x0001  /* Signed dirhash in use */
#define EXT2_FLAGS_UNSIGNED_HASH	0x0002  /* Unsigned dirhash in use */
#define EXT2_FLAGS_TEST_FILESYS		0x0004	/* to test development code */

/*
 * Mount flags set via mount options or defaults
 */
#define EXT4_MOUNT_NO_MBCACHE		0x00001 /* Do not use mbcache */
#define EXT4_MOUNT_GRPID		0x00004	/* Create files with directory's group */
#define EXT4_MOUNT_DEBUG		0x00008	/* Some debugging messages */
#define EXT4_MOUNT_ERRORS_CONT		0x00010	/* Continue on errors */
#define EXT4_MOUNT_ERRORS_RO		0x00020	/* Remount fs ro on errors */
#define EXT4_MOUNT_ERRORS_PANIC		0x00040	/* Panic on errors */
#define EXT4_MOUNT_ERRORS_MASK		0x00070
#define EXT4_MOUNT_MINIX_DF		0x00080	/* Mimics the Minix statfs */
#define EXT4_MOUNT_NOLOAD		0x00100	/* Don't use existing journal*/
#ifdef CONFIG_FS_DAX
#define EXT4_MOUNT_DAX_ALWAYS		0x00200	/* Direct Access */
#else
#define EXT4_MOUNT_DAX_ALWAYS		0
#endif
#define EXT4_MOUNT_DATA_FLAGS		0x00C00	/* Mode for data writes: */
#define EXT4_MOUNT_JOURNAL_DATA		0x00400	/* Write data to journal */
#define EXT4_MOUNT_ORDERED_DATA		0x00800	/* Flush data before commit */
#define EXT4_MOUNT_WRITEBACK_DATA	0x00C00	/* No data ordering */
#define EXT4_MOUNT_UPDATE_JOURNAL	0x01000	/* Update the journal format */
#define EXT4_MOUNT_NO_UID32		0x02000  /* Disable 32-bit UIDs */
#define EXT4_MOUNT_XATTR_USER		0x04000	/* Extended user attributes */
#define EXT4_MOUNT_POSIX_ACL		0x08000	/* POSIX Access Control Lists */
#define EXT4_MOUNT_NO_AUTO_DA_ALLOC	0x10000	/* No auto delalloc mapping */
#define EXT4_MOUNT_BARRIER		0x20000 /* Use block barriers */
#define EXT4_MOUNT_QUOTA		0x40000 /* Some quota option set */
#define EXT4_MOUNT_USRQUOTA		0x80000 /* "old" user quota,
						 * enable enforcement for hidden
						 * quota files */
#define EXT4_MOUNT_GRPQUOTA		0x100000 /* "old" group quota, enable
						  * enforcement for hidden quota
						  * files */
#define EXT4_MOUNT_PRJQUOTA		0x200000 /* Enable project quota
						  * enforcement */
#define EXT4_MOUNT_DIOREAD_NOLOCK	0x400000 /* Enable support for dio read nolocking */
#define EXT4_MOUNT_JOURNAL_CHECKSUM	0x800000 /* Journal checksums */
#define EXT4_MOUNT_JOURNAL_ASYNC_COMMIT	0x1000000 /* Journal Async Commit */
#define EXT4_MOUNT_WARN_ON_ERROR	0x2000000 /* Trigger WARN_ON on error */
#define EXT4_MOUNT_NO_PREFETCH_BLOCK_BITMAPS 0x4000000
#define EXT4_MOUNT_DELALLOC		0x8000000 /* Delalloc support */
#define EXT4_MOUNT_DATA_ERR_ABORT	0x10000000 /* Abort on file data write */
#define EXT4_MOUNT_BLOCK_VALIDITY	0x20000000 /* Block validity checking */
#define EXT4_MOUNT_DISCARD		0x40000000 /* Issue DISCARD requests */
#define EXT4_MOUNT_INIT_INODE_TABLE	0x80000000 /* Initialize uninitialized itables */

/*
 * Mount flags set either automatically (could not be set by mount option)
 * based on per file system feature or property or in special cases such as
 * distinguishing between explicit mount option definition and default.
 */
#define EXT4_MOUNT2_EXPLICIT_DELALLOC	0x00000001 /* User explicitly
						      specified delalloc */
#define EXT4_MOUNT2_STD_GROUP_SIZE	0x00000002 /* We have standard group
						      size of blocksize * 8
						      blocks */
#define EXT4_MOUNT2_HURD_COMPAT		0x00000004 /* Support HURD-castrated
						      file systems */
#define EXT4_MOUNT2_EXPLICIT_JOURNAL_CHECKSUM	0x00000008 /* User explicitly
						specified journal checksum */

#define EXT4_MOUNT2_JOURNAL_FAST_COMMIT	0x00000010 /* Journal fast commit */
#define EXT4_MOUNT2_DAX_NEVER		0x00000020 /* Do not allow Direct Access */
#define EXT4_MOUNT2_DAX_INODE		0x00000040 /* For printing options only */
#define EXT4_MOUNT2_MB_OPTIMIZE_SCAN	0x00000080 /* Optimize group
						    * scanning in mballoc
						    */
#define EXT4_MOUNT2_ABORT		0x00000100 /* Abort filesystem */

#define clear_opt(sb, opt)		EXT4_SB(sb)->s_mount_opt &= \
						~EXT4_MOUNT_##opt
#define set_opt(sb, opt)		EXT4_SB(sb)->s_mount_opt |= \
						EXT4_MOUNT_##opt
#define test_opt(sb, opt)		(EXT4_SB(sb)->s_mount_opt & \
					 EXT4_MOUNT_##opt)

#define clear_opt2(sb, opt)		EXT4_SB(sb)->s_mount_opt2 &= \
						~EXT4_MOUNT2_##opt
#define set_opt2(sb, opt)		EXT4_SB(sb)->s_mount_opt2 |= \
						EXT4_MOUNT2_##opt
#define test_opt2(sb, opt)		(EXT4_SB(sb)->s_mount_opt2 & \
					 EXT4_MOUNT2_##opt)

#define ext4_test_and_set_bit		__test_and_set_bit_le
#define ext4_set_bit			__set_bit_le
#define ext4_test_and_clear_bit		__test_and_clear_bit_le
#define ext4_clear_bit			__clear_bit_le
#define ext4_test_bit			test_bit_le
#define ext4_find_next_zero_bit		find_next_zero_bit_le
#define ext4_find_next_bit		find_next_bit_le

extern void mb_set_bits(void *bm, int cur, int len);

/*
 * Maximal mount counts between two filesystem checks
 */
#define EXT4_DFL_MAX_MNT_COUNT		20	/* Allow 20 mounts */
#define EXT4_DFL_CHECKINTERVAL		0	/* Don't use interval check */

/*
 * Behaviour when detecting errors
 */
#define EXT4_ERRORS_CONTINUE		1	/* Continue execution */
#define EXT4_ERRORS_RO			2	/* Remount fs read-only */
#define EXT4_ERRORS_PANIC		3	/* Panic */
#define EXT4_ERRORS_DEFAULT		EXT4_ERRORS_CONTINUE

/* Metadata checksum algorithm codes */
#define EXT4_CRC32C_CHKSUM		1

#define EXT4_LABEL_MAX			16

/*
 * Structure of the super block
 */
struct ext4_super_block {
/*00*/	__le32	s_inodes_count;		/* Inodes count */
	__le32	s_blocks_count_lo;	/* Blocks count */
	__le32	s_r_blocks_count_lo;	/* Reserved blocks count */
	__le32	s_free_blocks_count_lo;	/* Free blocks count */
/*10*/	__le32	s_free_inodes_count;	/* Free inodes count */
	__le32	s_first_data_block;	/* First Data Block */
	__le32	s_log_block_size;	/* Block size */
	__le32	s_log_cluster_size;	/* Allocation cluster size */
/*20*/	__le32	s_blocks_per_group;	/* # Blocks per group */
	__le32	s_clusters_per_group;	/* # Clusters per group */
	__le32	s_inodes_per_group;	/* # Inodes per group */
	__le32	s_mtime;		/* Mount time */
/*30*/	__le32	s_wtime;		/* Write time */
	__le16	s_mnt_count;		/* Mount count */
	__le16	s_max_mnt_count;	/* Maximal mount count */
	__le16	s_magic;		/* Magic signature */
	__le16	s_state;		/* File system state */
	__le16	s_errors;		/* Behaviour when detecting errors */
	__le16	s_minor_rev_level;	/* minor revision level */
/*40*/	__le32	s_lastcheck;		/* time of last check */
	__le32	s_checkinterval;	/* max. time between checks */
	__le32	s_creator_os;		/* OS */
	__le32	s_rev_level;		/* Revision level */
/*50*/	__le16	s_def_resuid;		/* Default uid for reserved blocks */
	__le16	s_def_resgid;		/* Default gid for reserved blocks */
	/*
	 * These fields are for EXT4_DYNAMIC_REV superblocks only.
	 *
	 * Note: the difference between the compatible feature set and
	 * the incompatible feature set is that if there is a bit set
	 * in the incompatible feature set that the kernel doesn't
	 * know about, it should refuse to mount the filesystem.
	 *
	 * e2fsck's requirements are more strict; if it doesn't know
	 * about a feature in either the compatible or incompatible
	 * feature set, it must abort and not try to meddle with
	 * things it doesn't understand...
	 */
	__le32	s_first_ino;		/* First non-reserved inode */
	__le16  s_inode_size;		/* size of inode structure */
	__le16	s_block_group_nr;	/* block group # of this superblock */
	__le32	s_feature_compat;	/* compatible feature set */
/*60*/	__le32	s_feature_incompat;	/* incompatible feature set */
	__le32	s_feature_ro_compat;	/* readonly-compatible feature set */
/*68*/	__u8	s_uuid[16];		/* 128-bit uuid for volume */
/*78*/	char	s_volume_name[EXT4_LABEL_MAX] __nonstring; /* volume name */
/*88*/	char	s_last_mounted[64] __nonstring;	/* directory where last mounted */
/*C8*/	__le32	s_algorithm_usage_bitmap; /* For compression */
	/*
	 * Performance hints.  Directory preallocation should only
	 * happen if the EXT4_FEATURE_COMPAT_DIR_PREALLOC flag is on.
	 */
	__u8	s_prealloc_blocks;	/* Nr of blocks to try to preallocate*/
	__u8	s_prealloc_dir_blocks;	/* Nr to preallocate for dirs */
	__le16	s_reserved_gdt_blocks;	/* Per group desc for online growth */
	/*
	 * Journaling support valid if EXT4_FEATURE_COMPAT_HAS_JOURNAL set.
	 */
/*D0*/	__u8	s_journal_uuid[16];	/* uuid of journal superblock */
/*E0*/	__le32	s_journal_inum;		/* inode number of journal file */
	__le32	s_journal_dev;		/* device number of journal file */
	__le32	s_last_orphan;		/* start of list of inodes to delete */
	__le32	s_hash_seed[4];		/* HTREE hash seed */
	__u8	s_def_hash_version;	/* Default hash version to use */
	__u8	s_jnl_backup_type;
	__le16  s_desc_size;		/* size of group descriptor */
/*100*/	__le32	s_default_mount_opts;
	__le32	s_first_meta_bg;	/* First metablock block group */
	__le32	s_mkfs_time;		/* When the filesystem was created */
	__le32	s_jnl_blocks[17];	/* Backup of the journal inode */
	/* 64bit support valid if EXT4_FEATURE_INCOMPAT_64BIT */
/*150*/	__le32	s_blocks_count_hi;	/* Blocks count */
	__le32	s_r_blocks_count_hi;	/* Reserved blocks count */
	__le32	s_free_blocks_count_hi;	/* Free blocks count */
	__le16	s_min_extra_isize;	/* All inodes have at least # bytes */
	__le16	s_want_extra_isize; 	/* New inodes should reserve # bytes */
	__le32	s_flags;		/* Miscellaneous flags */
	__le16  s_raid_stride;		/* RAID stride */
	__le16  s_mmp_update_interval;  /* # seconds to wait in MMP checking */
	__le64  s_mmp_block;            /* Block for multi-mount protection */
	__le32  s_raid_stripe_width;    /* blocks on all data disks (N*stride)*/
	__u8	s_log_groups_per_flex;  /* FLEX_BG group size */
	__u8	s_checksum_type;	/* metadata checksum algorithm used */
	__u8	s_encryption_level;	/* versioning level for encryption */
	__u8	s_reserved_pad;		/* Padding to next 32bits */
	__le64	s_kbytes_written;	/* nr of lifetime kilobytes written */
	__le32	s_snapshot_inum;	/* Inode number of active snapshot */
	__le32	s_snapshot_id;		/* sequential ID of active snapshot */
	__le64	s_snapshot_r_blocks_count; /* reserved blocks for active
					      snapshot's future use */
	__le32	s_snapshot_list;	/* inode number of the head of the
					   on-disk snapshot list */
#define EXT4_S_ERR_START offsetof(struct ext4_super_block, s_error_count)
	__le32	s_error_count;		/* number of fs errors */
	__le32	s_first_error_time;	/* first time an error happened */
	__le32	s_first_error_ino;	/* inode involved in first error */
	__le64	s_first_error_block;	/* block involved of first error */
	__u8	s_first_error_func[32] __nonstring;	/* function where the error happened */
	__le32	s_first_error_line;	/* line number where error happened */
	__le32	s_last_error_time;	/* most recent time of an error */
	__le32	s_last_error_ino;	/* inode involved in last error */
	__le32	s_last_error_line;	/* line number where error happened */
	__le64	s_last_error_block;	/* block involved of last error */
	__u8	s_last_error_func[32] __nonstring;	/* function where the error happened */
#define EXT4_S_ERR_END offsetof(struct ext4_super_block, s_mount_opts)
	__u8	s_mount_opts[64];
	__le32	s_usr_quota_inum;	/* inode for tracking user quota */
	__le32	s_grp_quota_inum;	/* inode for tracking group quota */
	__le32	s_overhead_clusters;	/* overhead blocks/clusters in fs */
	__le32	s_backup_bgs[2];	/* groups with sparse_super2 SBs */
	__u8	s_encrypt_algos[4];	/* Encryption algorithms in use  */
	__u8	s_encrypt_pw_salt[16];	/* Salt used for string2key algorithm */
	__le32	s_lpf_ino;		/* Location of the lost+found inode */
	__le32	s_prj_quota_inum;	/* inode for tracking project quota */
	__le32	s_checksum_seed;	/* crc32c(uuid) if csum_seed set */
	__u8	s_wtime_hi;
	__u8	s_mtime_hi;
	__u8	s_mkfs_time_hi;
	__u8	s_lastcheck_hi;
	__u8	s_first_error_time_hi;
	__u8	s_last_error_time_hi;
	__u8	s_first_error_errcode;
	__u8    s_last_error_errcode;
	__le16  s_encoding;		/* Filename charset encoding */
	__le16  s_encoding_flags;	/* Filename charset encoding flags */
	__le32  s_orphan_file_inum;	/* Inode for tracking orphan inodes */
	__le32	s_reserved[94];		/* Padding to the end of the block */
	__le32	s_checksum;		/* crc32c(superblock) */
};

#define EXT4_S_ERR_LEN (EXT4_S_ERR_END - EXT4_S_ERR_START)

#ifdef __KERNEL__

/* Number of quota types we support */
#define EXT4_MAXQUOTAS 3

#define EXT4_ENC_UTF8_12_1	1

/* Types of ext4 journal triggers */
enum ext4_journal_trigger_type {
	EXT4_JTR_ORPHAN_FILE,
	EXT4_JTR_NONE	/* This must be the last entry for indexing to work! */
};

#define EXT4_JOURNAL_TRIGGER_COUNT EXT4_JTR_NONE

struct ext4_journal_trigger {
	struct jbd2_buffer_trigger_type tr_triggers;
	struct super_block *sb;
};

static inline struct ext4_journal_trigger *EXT4_TRIGGER(
				struct jbd2_buffer_trigger_type *trigger)
{
	return container_of(trigger, struct ext4_journal_trigger, tr_triggers);
}

#define EXT4_ORPHAN_BLOCK_MAGIC 0x0b10ca04

/* Structure at the tail of orphan block */
struct ext4_orphan_block_tail {
	__le32 ob_magic;
	__le32 ob_checksum;
};

static inline int ext4_inodes_per_orphan_block(struct super_block *sb)
{
	return (sb->s_blocksize - sizeof(struct ext4_orphan_block_tail)) /
			sizeof(u32);
}

struct ext4_orphan_block {
	atomic_t ob_free_entries;	/* Number of free orphan entries in block */
	struct buffer_head *ob_bh;	/* Buffer for orphan block */
};

/*
 * Info about orphan file.
 */
struct ext4_orphan_info {
	int of_blocks;			/* Number of orphan blocks in a file */
	__u32 of_csum_seed;		/* Checksum seed for orphan file */
	struct ext4_orphan_block *of_binfo;	/* Array with info about orphan
						 * file blocks */
};

/*
 * fourth extended-fs super-block data in memory
 */
struct ext4_sb_info {
	unsigned long s_desc_size;	/* Size of a group descriptor in bytes */
	unsigned long s_inodes_per_block;/* Number of inodes per block */
	unsigned long s_blocks_per_group;/* Number of blocks in a group */
	unsigned long s_clusters_per_group; /* Number of clusters in a group */
	unsigned long s_inodes_per_group;/* Number of inodes in a group */
	unsigned long s_itb_per_group;	/* Number of inode table blocks per group */
	unsigned long s_gdb_count;	/* Number of group descriptor blocks */
	unsigned long s_desc_per_block;	/* Number of group descriptors per block */
	ext4_group_t s_groups_count;	/* Number of groups in the fs */
	ext4_group_t s_blockfile_groups;/* Groups acceptable for non-extent files */
	unsigned long s_overhead;  /* # of fs overhead clusters */
	unsigned int s_cluster_ratio;	/* Number of blocks per cluster */
	unsigned int s_cluster_bits;	/* log2 of s_cluster_ratio */
	loff_t s_bitmap_maxbytes;	/* max bytes for bitmap files */
	struct buffer_head * s_sbh;	/* Buffer containing the super block */
	struct ext4_super_block *s_es;	/* Pointer to the super block in the buffer */
	/* Array of bh's for the block group descriptors */
	struct buffer_head * __rcu *s_group_desc;
	unsigned int s_mount_opt;
	unsigned int s_mount_opt2;
	unsigned long s_mount_flags;
	unsigned int s_def_mount_opt;
	unsigned int s_def_mount_opt2;
	ext4_fsblk_t s_sb_block;
	atomic64_t s_resv_clusters;
	kuid_t s_resuid;
	kgid_t s_resgid;
	unsigned short s_mount_state;
	unsigned short s_pad;
	int s_addr_per_block_bits;
	int s_desc_per_block_bits;
	int s_inode_size;
	int s_first_ino;
	unsigned int s_inode_readahead_blks;
	unsigned int s_inode_goal;
	u32 s_hash_seed[4];
	int s_def_hash_version;
	int s_hash_unsigned;	/* 3 if hash should be unsigned, 0 if not */
	struct percpu_counter s_freeclusters_counter;
	struct percpu_counter s_freeinodes_counter;
	struct percpu_counter s_dirs_counter;
	struct percpu_counter s_dirtyclusters_counter;
	struct percpu_counter s_sra_exceeded_retry_limit;
	struct blockgroup_lock *s_blockgroup_lock;
	struct proc_dir_entry *s_proc;
	struct kobject s_kobj;
	struct completion s_kobj_unregister;
	struct super_block *s_sb;
	struct buffer_head *s_mmp_bh;

	/* Journaling */
	struct journal_s *s_journal;
	unsigned long s_ext4_flags;		/* Ext4 superblock flags */
	struct mutex s_orphan_lock;	/* Protects on disk list changes */
	struct list_head s_orphan;	/* List of orphaned inodes in on disk
					   list */
	struct ext4_orphan_info s_orphan_info;
	unsigned long s_commit_interval;
	u32 s_max_batch_time;
	u32 s_min_batch_time;
	struct file *s_journal_bdev_file;
#ifdef CONFIG_QUOTA
	/* Names of quota files with journalled quota */
	char __rcu *s_qf_names[EXT4_MAXQUOTAS];
	int s_jquota_fmt;			/* Format of quota to use */
#endif
	unsigned int s_want_extra_isize; /* New inodes should reserve # bytes */
	struct ext4_system_blocks __rcu *s_system_blks;

#ifdef EXTENTS_STATS
	/* ext4 extents stats */
	unsigned long s_ext_min;
	unsigned long s_ext_max;
	unsigned long s_depth_max;
	spinlock_t s_ext_stats_lock;
	unsigned long s_ext_blocks;
	unsigned long s_ext_extents;
#endif

	/* for buddy allocator */
	struct ext4_group_info ** __rcu *s_group_info;
	struct inode *s_buddy_cache;
	spinlock_t s_md_lock;
	unsigned short *s_mb_offsets;
	unsigned int *s_mb_maxs;
	unsigned int s_group_info_size;
	atomic_t s_mb_free_pending;
	struct list_head s_freed_data_list[2];	/* List of blocks to be freed
						   after commit completed */
	struct list_head s_discard_list;
	struct work_struct s_discard_work;
	atomic_t s_retry_alloc_pending;
	struct xarray *s_mb_avg_fragment_size;
	struct xarray *s_mb_largest_free_orders;

	/* tunables */
	unsigned long s_stripe;
	unsigned int s_mb_max_linear_groups;
	unsigned int s_mb_stream_request;
	unsigned int s_mb_max_to_scan;
	unsigned int s_mb_min_to_scan;
	unsigned int s_mb_stats;
	unsigned int s_mb_order2_reqs;
	unsigned int s_mb_group_prealloc;
	unsigned int s_max_dir_size_kb;
	unsigned int s_mb_prefetch;
	unsigned int s_mb_prefetch_limit;
	unsigned int s_mb_best_avail_max_trim_order;
	unsigned int s_sb_update_sec;
	unsigned int s_sb_update_kb;

	/* where last allocation was done - for stream allocation */
	ext4_group_t *s_mb_last_groups;
	unsigned int s_mb_nr_global_goals;

	/* stats for buddy allocator */
	atomic_t s_bal_reqs;	/* number of reqs with len > 1 */
	atomic_t s_bal_success;	/* we found long enough chunks */
	atomic_t s_bal_allocated;	/* in blocks */
	atomic_t s_bal_ex_scanned;	/* total extents scanned */
	atomic_t s_bal_cX_ex_scanned[EXT4_MB_NUM_CRS];	/* total extents scanned */
	atomic_t s_bal_groups_scanned;	/* number of groups scanned */
	atomic_t s_bal_goals;	/* goal hits */
	atomic_t s_bal_stream_goals;	/* stream allocation global goal hits */
	atomic_t s_bal_len_goals;	/* len goal hits */
	atomic_t s_bal_breaks;	/* too long searches */
	atomic_t s_bal_2orders;	/* 2^order hits */
	atomic64_t s_bal_cX_groups_considered[EXT4_MB_NUM_CRS];
	atomic64_t s_bal_cX_hits[EXT4_MB_NUM_CRS];
	atomic64_t s_bal_cX_failed[EXT4_MB_NUM_CRS];		/* cX loop didn't find blocks */
	atomic_t s_mb_buddies_generated;	/* number of buddies generated */
	atomic64_t s_mb_generation_time;
	atomic_t s_mb_lost_chunks;
	atomic_t s_mb_preallocated;
	atomic_t s_mb_discarded;
	atomic_t s_lock_busy;

	/* locality groups */
	struct ext4_locality_group __percpu *s_locality_groups;

	/* for write statistics */
	unsigned long s_sectors_written_start;
	u64 s_kbytes_written;

	/* the size of zero-out chunk */
	unsigned int s_extent_max_zeroout_kb;

	unsigned int s_log_groups_per_flex;
	struct flex_groups * __rcu *s_flex_groups;
	ext4_group_t s_flex_groups_allocated;

	/* workqueue for reserved extent conversions (buffered io) */
	struct workqueue_struct *rsv_conversion_wq;

	/* timer for periodic error stats printing */
	struct timer_list s_err_report;

	/* Lazy inode table initialization info */
	struct ext4_li_request *s_li_request;
	/* Wait multiplier for lazy initialization thread */
	unsigned int s_li_wait_mult;

	/* Kernel thread for multiple mount protection */
	struct task_struct *s_mmp_tsk;

	/* record the last minlen when FITRIM is called. */
	unsigned long s_last_trim_minblks;

	/* Precomputed FS UUID checksum for seeding other checksums */
	__u32 s_csum_seed;

	/* Reclaim extents from extent status tree */
	struct shrinker *s_es_shrinker;
	struct list_head s_es_list;	/* List of inodes with reclaimable extents */
	long s_es_nr_inode;
	struct ext4_es_stats s_es_stats;
	struct mb_cache *s_ea_block_cache;
	struct mb_cache *s_ea_inode_cache;
	spinlock_t s_es_lock ____cacheline_aligned_in_smp;

	/* Journal triggers for checksum computation */
	struct ext4_journal_trigger s_journal_triggers[EXT4_JOURNAL_TRIGGER_COUNT];

	/* Ratelimit ext4 messages. */
	struct ratelimit_state s_err_ratelimit_state;
	struct ratelimit_state s_warning_ratelimit_state;
	struct ratelimit_state s_msg_ratelimit_state;
	atomic_t s_warning_count;
	atomic_t s_msg_count;

	/* Encryption policy for '-o test_dummy_encryption' */
	struct fscrypt_dummy_policy s_dummy_enc_policy;

	/*
	 * Barrier between writepages ops and changing any inode's JOURNAL_DATA
	 * or EXTENTS flag or between writepages ops and changing DELALLOC or
	 * DIOREAD_NOLOCK mount options on remount.
	 */
	struct percpu_rw_semaphore s_writepages_rwsem;
	struct dax_device *s_daxdev;
	u64 s_dax_part_off;
#ifdef CONFIG_EXT4_DEBUG
	unsigned long s_simulate_fail;
#endif
	/* Record the errseq of the backing block device */
	errseq_t s_bdev_wb_err;
	spinlock_t s_bdev_wb_lock;

	/* Information about errors that happened during this mount */
	spinlock_t s_error_lock;
	int s_add_error_count;
	int s_first_error_code;
	__u32 s_first_error_line;
	__u32 s_first_error_ino;
	__u64 s_first_error_block;
	const char *s_first_error_func;
	time64_t s_first_error_time;
	int s_last_error_code;
	__u32 s_last_error_line;
	__u32 s_last_error_ino;
	__u64 s_last_error_block;
	const char *s_last_error_func;
	time64_t s_last_error_time;
	/*
	 * If we are in a context where we cannot update the on-disk
	 * superblock, we queue the work here.  This is used to update
	 * the error information in the superblock, and for periodic
	 * updates of the superblock called from the commit callback
	 * function.
	 */
	struct work_struct s_sb_upd_work;

	/* Atomic write unit values in bytes */
	unsigned int s_awu_min;
	unsigned int s_awu_max;

	/* Ext4 fast commit sub transaction ID */
	atomic_t s_fc_subtid;

	/*
	 * After commit starts, the main queue gets locked, and the further
	 * updates get added in the staging queue.
	 */
#define FC_Q_MAIN	0
#define FC_Q_STAGING	1
	struct list_head s_fc_q[2];	/* Inodes staged for fast commit
					 * that have data changes in them.
					 */
	struct list_head s_fc_dentry_q[2];	/* directory entry updates */
	unsigned int s_fc_bytes;
	/*
	 * Main fast commit lock. This lock protects accesses to the
	 * following fields:
	 * ei->i_fc_list, s_fc_dentry_q, s_fc_q, s_fc_bytes, s_fc_bh.
	 */
	struct mutex s_fc_lock;
	struct buffer_head *s_fc_bh;
	struct ext4_fc_stats s_fc_stats;
	tid_t s_fc_ineligible_tid;
#ifdef CONFIG_EXT4_DEBUG
	int s_fc_debug_max_replay;
#endif
	struct ext4_fc_replay_state s_fc_replay_state;
};

static inline struct ext4_sb_info *EXT4_SB(struct super_block *sb)
{
	return sb->s_fs_info;
}
static inline struct ext4_inode_info *EXT4_I(struct inode *inode)
{
	return container_of(inode, struct ext4_inode_info, vfs_inode);
}

static inline int ext4_writepages_down_read(struct super_block *sb)
{
	percpu_down_read(&EXT4_SB(sb)->s_writepages_rwsem);
	return memalloc_nofs_save();
}

static inline void ext4_writepages_up_read(struct super_block *sb, int ctx)
{
	memalloc_nofs_restore(ctx);
	percpu_up_read(&EXT4_SB(sb)->s_writepages_rwsem);
}

static inline int ext4_writepages_down_write(struct super_block *sb)
{
	percpu_down_write(&EXT4_SB(sb)->s_writepages_rwsem);
	return memalloc_nofs_save();
}

static inline void ext4_writepages_up_write(struct super_block *sb, int ctx)
{
	memalloc_nofs_restore(ctx);
	percpu_up_write(&EXT4_SB(sb)->s_writepages_rwsem);
}

static inline int ext4_valid_inum(struct super_block *sb, unsigned long ino)
{
	return ino == EXT4_ROOT_INO ||
		(ino >= EXT4_FIRST_INO(sb) &&
		 ino <= le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count));
}

/*
 * Returns: sbi->field[index]
 * Used to access an array element from the following sbi fields which require
 * rcu protection to avoid dereferencing an invalid pointer due to reassignment
 * - s_group_desc
 * - s_group_info
 * - s_flex_group
 */
#define sbi_array_rcu_deref(sbi, field, index)				   \
({									   \
	typeof(*((sbi)->field)) _v;					   \
	rcu_read_lock();						   \
	_v = ((typeof(_v)*)rcu_dereference((sbi)->field))[index];	   \
	rcu_read_unlock();						   \
	_v;								   \
})

/*
 * run-time mount flags
 */
enum {
	EXT4_MF_MNTDIR_SAMPLED,
	EXT4_MF_FC_INELIGIBLE,	/* Fast commit ineligible */
	EXT4_MF_JOURNAL_DESTROY	/* Journal is in process of destroying */
};

static inline void ext4_set_mount_flag(struct super_block *sb, int bit)
{
	set_bit(bit, &EXT4_SB(sb)->s_mount_flags);
}

static inline void ext4_clear_mount_flag(struct super_block *sb, int bit)
{
	clear_bit(bit, &EXT4_SB(sb)->s_mount_flags);
}

static inline int ext4_test_mount_flag(struct super_block *sb, int bit)
{
	return test_bit(bit, &EXT4_SB(sb)->s_mount_flags);
}


/*
 * Simulate_fail codes
 */
#define EXT4_SIM_BBITMAP_EIO	1
#define EXT4_SIM_BBITMAP_CRC	2
#define EXT4_SIM_IBITMAP_EIO	3
#define EXT4_SIM_IBITMAP_CRC	4
#define EXT4_SIM_INODE_EIO	5
#define EXT4_SIM_INODE_CRC	6
#define EXT4_SIM_DIRBLOCK_EIO	7
#define EXT4_SIM_DIRBLOCK_CRC	8

static inline bool ext4_simulate_fail(struct super_block *sb,
				     unsigned long code)
{
#ifdef CONFIG_EXT4_DEBUG
	struct ext4_sb_info *sbi = EXT4_SB(sb);

	if (unlikely(sbi->s_simulate_fail == code)) {
		sbi->s_simulate_fail = 0;
		return true;
	}
#endif
	return false;
}

/*
 * Error number codes for s_{first,last}_error_errno
 *
 * Linux errno numbers are architecture specific, so we need to translate
 * them into something which is architecture independent.   We don't define
 * codes for all errno's; just the ones which are most likely to be the cause
 * of an ext4_error() call.
 */
#define EXT4_ERR_UNKNOWN	 1
#define EXT4_ERR_EIO		 2
#define EXT4_ERR_ENOMEM		 3
#define EXT4_ERR_EFSBADCRC	 4
#define EXT4_ERR_EFSCORRUPTED	 5
#define EXT4_ERR_ENOSPC		 6
#define EXT4_ERR_ENOKEY		 7
#define EXT4_ERR_EROFS		 8
#define EXT4_ERR_EFBIG		 9
#define EXT4_ERR_EEXIST		10
#define EXT4_ERR_ERANGE		11
#define EXT4_ERR_EOVERFLOW	12
#define EXT4_ERR_EBUSY		13
#define EXT4_ERR_ENOTDIR	14
#define EXT4_ERR_ENOTEMPTY	15
#define EXT4_ERR_ESHUTDOWN	16
#define EXT4_ERR_EFAULT		17

/*
 * Inode dynamic state flags
 */
enum {
	EXT4_STATE_NEW,			/* inode is newly created */
	EXT4_STATE_XATTR,		/* has in-inode xattrs */
	EXT4_STATE_NO_EXPAND,		/* No space for expansion */
	EXT4_STATE_DA_ALLOC_CLOSE,	/* Alloc DA blks on close */
	EXT4_STATE_EXT_MIGRATE,		/* Inode is migrating */
	EXT4_STATE_NEWENTRY,		/* File just added to dir */
	EXT4_STATE_MAY_INLINE_DATA,	/* may have in-inode data */
	EXT4_STATE_EXT_PRECACHED,	/* extents have been precached */
	EXT4_STATE_LUSTRE_EA_INODE,	/* Lustre-style ea_inode */
	EXT4_STATE_VERITY_IN_PROGRESS,	/* building fs-verity Merkle tree */
	EXT4_STATE_FC_COMMITTING,	/* Fast commit ongoing */
	EXT4_STATE_FC_FLUSHING_DATA,	/* Fast commit flushing data */
	EXT4_STATE_ORPHAN_FILE,		/* Inode orphaned in orphan file */
};

#define EXT4_INODE_BIT_FNS(name, field, offset)				\
static inline int ext4_test_inode_##name(struct inode *inode, int bit)	\
{									\
	return test_bit(bit + (offset), &EXT4_I(inode)->i_##field);	\
}									\
static inline void ext4_set_inode_##name(struct inode *inode, int bit)	\
{									\
	set_bit(bit + (offset), &EXT4_I(inode)->i_##field);		\
}									\
static inline void ext4_clear_inode_##name(struct inode *inode, int bit) \
{									\
	clear_bit(bit + (offset), &EXT4_I(inode)->i_##field);		\
}

/* Add these declarations here only so that these functions can be
 * found by name.  Otherwise, they are very hard to locate. */
static inline int ext4_test_inode_flag(struct inode *inode, int bit);
static inline void ext4_set_inode_flag(struct inode *inode, int bit);
static inline void ext4_clear_inode_flag(struct inode *inode, int bit);
EXT4_INODE_BIT_FNS(flag, flags, 0)

/* Add these declarations here only so that these functions can be
 * found by name.  Otherwise, they are very hard to locate. */
static inline int ext4_test_inode_state(struct inode *inode, int bit);
static inline void ext4_set_inode_state(struct inode *inode, int bit);
static inline void ext4_clear_inode_state(struct inode *inode, int bit);
#if (BITS_PER_LONG < 64)
EXT4_INODE_BIT_FNS(state, state_flags, 0)

static inline void ext4_clear_state_flags(struct ext4_inode_info *ei)
{
	(ei)->i_state_flags = 0;
}
#else
EXT4_INODE_BIT_FNS(state, flags, 32)

static inline void ext4_clear_state_flags(struct ext4_inode_info *ei)
{
	/* We depend on the fact that callers will set i_flags */
}
#endif
#else
/* Assume that user mode programs are passing in an ext4fs superblock, not
 * a kernel struct super_block.  This will allow us to call the feature-test
 * macros from user land. */
#define EXT4_SB(sb)	(sb)
#endif

static inline bool ext4_verity_in_progress(struct inode *inode)
{
	return IS_ENABLED(CONFIG_FS_VERITY) &&
	       ext4_test_inode_state(inode, EXT4_STATE_VERITY_IN_PROGRESS);
}

#define NEXT_ORPHAN(inode) EXT4_I(inode)->i_dtime

/*
 * Codes for operating systems
 */
#define EXT4_OS_LINUX		0
#define EXT4_OS_HURD		1
#define EXT4_OS_MASIX		2
#define EXT4_OS_FREEBSD		3
#define EXT4_OS_LITES		4

/*
 * Revision levels
 */
#define EXT4_GOOD_OLD_REV	0	/* The good old (original) format */
#define EXT4_DYNAMIC_REV	1	/* V2 format w/ dynamic inode sizes */

#define EXT4_MAX_SUPP_REV	EXT4_DYNAMIC_REV

#define EXT4_GOOD_OLD_INODE_SIZE 128

#define EXT4_EXTRA_TIMESTAMP_MAX	(((s64)1 << 34) - 1  + S32_MIN)
#define EXT4_NON_EXTRA_TIMESTAMP_MAX	S32_MAX
#define EXT4_TIMESTAMP_MIN		S32_MIN

/*
 * Feature set definitions
 */

#define EXT4_FEATURE_COMPAT_DIR_PREALLOC	0x0001
#define EXT4_FEATURE_COMPAT_IMAGIC_INODES	0x0002
#define EXT4_FEATURE_COMPAT_HAS_JOURNAL		0x0004
#define EXT4_FEATURE_COMPAT_EXT_ATTR		0x0008
#define EXT4_FEATURE_COMPAT_RESIZE_INODE	0x0010
#define EXT4_FEATURE_COMPAT_DIR_INDEX		0x0020
#define EXT4_FEATURE_COMPAT_SPARSE_SUPER2	0x0200
/*
 * The reason why "FAST_COMMIT" is a compat feature is that, FS becomes
 * incompatible only if fast commit blocks are present in the FS. Since we
 * clear the journal (and thus the fast commit blocks), we don't mark FS as
 * incompatible. We also have a JBD2 incompat feature, which gets set when
 * there are fast commit blocks present in the journal.
 */
#define EXT4_FEATURE_COMPAT_FAST_COMMIT		0x0400
#define EXT4_FEATURE_COMPAT_STABLE_INODES	0x0800
#define EXT4_FEATURE_COMPAT_ORPHAN_FILE		0x1000	/* Orphan file exists */

#define EXT4_FEATURE_RO_COMPAT_SPARSE_SUPER	0x0001
#define EXT4_FEATURE_RO_COMPAT_LARGE_FILE	0x0002
#define EXT4_FEATURE_RO_COMPAT_BTREE_DIR	0x0004
#define EXT4_FEATURE_RO_COMPAT_HUGE_FILE        0x0008
#define EXT4_FEATURE_RO_COMPAT_GDT_CSUM		0x0010
#define EXT4_FEATURE_RO_COMPAT_DIR_NLINK	0x0020
#define EXT4_FEATURE_RO_COMPAT_EXTRA_ISIZE	0x0040
#define EXT4_FEATURE_RO_COMPAT_QUOTA		0x0100
#define EXT4_FEATURE_RO_COMPAT_BIGALLOC		0x0200
/*
 * METADATA_CSUM also enables group descriptor checksums (GDT_CSUM).  When
 * METADATA_CSUM is set, group descriptor checksums use the same algorithm as
 * all other data structures' checksums.  However, the METADATA_CSUM and
 * GDT_CSUM bits are mutually exclusive.
 */
#define EXT4_FEATURE_RO_COMPAT_METADATA_CSUM	0x0400
#define EXT4_FEATURE_RO_COMPAT_READONLY		0x1000
#define EXT4_FEATURE_RO_COMPAT_PROJECT		0x2000
#define EXT4_FEATURE_RO_COMPAT_VERITY		0x8000
#define EXT4_FEATURE_RO_COMPAT_ORPHAN_PRESENT	0x10000 /* Orphan file may be
							   non-empty */

#define EXT4_FEATURE_INCOMPAT_COMPRESSION	0x0001
#define EXT4_FEATURE_INCOMPAT_FILETYPE		0x0002
#define EXT4_FEATURE_INCOMPAT_RECOVER		0x0004 /* Needs recovery */
#define EXT4_FEATURE_INCOMPAT_JOURNAL_DEV	0x0008 /* Journal device */
#define EXT4_FEATURE_INCOMPAT_META_BG		0x0010
#define EXT4_FEATURE_INCOMPAT_EXTENTS		0x0040 /* extents support */
#define EXT4_FEATURE_INCOMPAT_64BIT		0x0080
#define EXT4_FEATURE_INCOMPAT_MMP               0x0100
#define EXT4_FEATURE_INCOMPAT_FLEX_BG		0x0200
#define EXT4_FEATURE_INCOMPAT_EA_INODE		0x0400 /* EA in inode */
#define EXT4_FEATURE_INCOMPAT_DIRDATA		0x1000 /* data in dirent */
#define EXT4_FEATURE_INCOMPAT_CSUM_SEED		0x2000
#define EXT4_FEATURE_INCOMPAT_LARGEDIR		0x4000 /* >2GB or 3-lvl htree */
#define EXT4_FEATURE_INCOMPAT_INLINE_DATA	0x8000 /* data in inode */
#define EXT4_FEATURE_INCOMPAT_ENCRYPT		0x10000
#define EXT4_FEATURE_INCOMPAT_CASEFOLD		0x20000

extern void ext4_update_dynamic_rev(struct super_block *sb);

#define EXT4_FEATURE_COMPAT_FUNCS(name, flagname) \
static inline bool ext4_has_feature_##name(struct super_block *sb) \
{ \
	return ((EXT4_SB(sb)->s_es->s_feature_compat & \
		cpu_to_le32(EXT4_FEATURE_COMPAT_##flagname)) != 0); \
} \
static inline void ext4_set_feature_##name(struct super_block *sb) \
{ \
	ext4_update_dynamic_rev(sb); \
	EXT4_SB(sb)->s_es->s_feature_compat |= \
		cpu_to_le32(EXT4_FEATURE_COMPAT_##flagname); \
} \
static inline void ext4_clear_feature_##name(struct super_block *sb) \
{ \
	EXT4_SB(sb)->s_es->s_feature_compat &= \
		~cpu_to_le32(EXT4_FEATURE_COMPAT_##flagname); \
}

#define EXT4_FEATURE_RO_COMPAT_FUNCS(name, flagname) \
static inline bool ext4_has_feature_##name(struct super_block *sb) \
{ \
	return ((EXT4_SB(sb)->s_es->s_feature_ro_compat & \
		cpu_to_le32(EXT4_FEATURE_RO_COMPAT_##flagname)) != 0); \
} \
static inline void ext4_set_feature_##name(struct super_block *sb) \
{ \
	ext4_update_dynamic_rev(sb); \
	EXT4_SB(sb)->s_es->s_feature_ro_compat |= \
		cpu_to_le32(EXT4_FEATURE_RO_COMPAT_##flagname); \
} \
static inline void ext4_clear_feature_##name(struct super_block *sb) \
{ \
	EXT4_SB(sb)->s_es->s_feature_ro_compat &= \
		~cpu_to_le32(EXT4_FEATURE_RO_COMPAT_##flagname); \
}

#define EXT4_FEATURE_INCOMPAT_FUNCS(name, flagname) \
static inline bool ext4_has_feature_##name(struct super_block *sb) \
{ \
	return ((EXT4_SB(sb)->s_es->s_feature_incompat & \
		cpu_to_le32(EXT4_FEATURE_INCOMPAT_##flagname)) != 0); \
} \
static inline void ext4_set_feature_##name(struct super_block *sb) \
{ \
	ext4_update_dynamic_rev(sb); \
	EXT4_SB(sb)->s_es->s_feature_incompat |= \
		cpu_to_le32(EXT4_FEATURE_INCOMPAT_##flagname); \
} \
static inline void ext4_clear_feature_##name(struct super_block *sb) \
{ \
	EXT4_SB(sb)->s_es->s_feature_incompat &= \
		~cpu_to_le32(EXT4_FEATURE_INCOMPAT_##flagname); \
}

EXT4_FEATURE_COMPAT_FUNCS(dir_prealloc,		DIR_PREALLOC)
EXT4_FEATURE_COMPAT_FUNCS(imagic_inodes,	IMAGIC_INODES)
EXT4_FEATURE_COMPAT_FUNCS(journal,		HAS_JOURNAL)
EXT4_FEATURE_COMPAT_FUNCS(xattr,		EXT_ATTR)
EXT4_FEATURE_COMPAT_FUNCS(resize_inode,		RESIZE_INODE)
EXT4_FEATURE_COMPAT_FUNCS(dir_index,		DIR_INDEX)
EXT4_FEATURE_COMPAT_FUNCS(sparse_super2,	SPARSE_SUPER2)
EXT4_FEATURE_COMPAT_FUNCS(fast_commit,		FAST_COMMIT)
EXT4_FEATURE_COMPAT_FUNCS(stable_inodes,	STABLE_INODES)
EXT4_FEATURE_COMPAT_FUNCS(orphan_file,		ORPHAN_FILE)

EXT4_FEATURE_RO_COMPAT_FUNCS(sparse_super,	SPARSE_SUPER)
EXT4_FEATURE_RO_COMPAT_FUNCS(large_file,	LARGE_FILE)
EXT4_FEATURE_RO_COMPAT_FUNCS(btree_dir,		BTREE_DIR)
EXT4_FEATURE_RO_COMPAT_FUNCS(huge_file,		HUGE_FILE)
EXT4_FEATURE_RO_COMPAT_FUNCS(gdt_csum,		GDT_CSUM)
EXT4_FEATURE_RO_COMPAT_FUNCS(dir_nlink,		DIR_NLINK)
EXT4_FEATURE_RO_COMPAT_FUNCS(extra_isize,	EXTRA_ISIZE)
EXT4_FEATURE_RO_COMPAT_FUNCS(quota,		QUOTA)
EXT4_FEATURE_RO_COMPAT_FUNCS(bigalloc,		BIGALLOC)
EXT4_FEATURE_RO_COMPAT_FUNCS(metadata_csum,	METADATA_CSUM)
EXT4_FEATURE_RO_COMPAT_FUNCS(readonly,		READONLY)
EXT4_FEATURE_RO_COMPAT_FUNCS(project,		PROJECT)
EXT4_FEATURE_RO_COMPAT_FUNCS(verity,		VERITY)
EXT4_FEATURE_RO_COMPAT_FUNCS(orphan_present,	ORPHAN_PRESENT)

EXT4_FEATURE_INCOMPAT_FUNCS(compression,	COMPRESSION)
EXT4_FEATURE_INCOMPAT_FUNCS(filetype,		FILETYPE)
EXT4_FEATURE_INCOMPAT_FUNCS(journal_needs_recovery,	RECOVER)
EXT4_FEATURE_INCOMPAT_FUNCS(journal_dev,	JOURNAL_DEV)
EXT4_FEATURE_INCOMPAT_FUNCS(meta_bg,		META_BG)
EXT4_FEATURE_INCOMPAT_FUNCS(extents,		EXTENTS)
EXT4_FEATURE_INCOMPAT_FUNCS(64bit,		64BIT)
EXT4_FEATURE_INCOMPAT_FUNCS(mmp,		MMP)
EXT4_FEATURE_INCOMPAT_FUNCS(flex_bg,		FLEX_BG)
EXT4_FEATURE_INCOMPAT_FUNCS(ea_inode,		EA_INODE)
EXT4_FEATURE_INCOMPAT_FUNCS(dirdata,		DIRDATA)
EXT4_FEATURE_INCOMPAT_FUNCS(csum_seed,		CSUM_SEED)
EXT4_FEATURE_INCOMPAT_FUNCS(largedir,		LARGEDIR)
EXT4_FEATURE_INCOMPAT_FUNCS(inline_data,	INLINE_DATA)
EXT4_FEATURE_INCOMPAT_FUNCS(encrypt,		ENCRYPT)
EXT4_FEATURE_INCOMPAT_FUNCS(casefold,		CASEFOLD)

#define EXT2_FEATURE_COMPAT_SUPP	EXT4_FEATURE_COMPAT_EXT_ATTR
#define EXT2_FEATURE_INCOMPAT_SUPP	(EXT4_FEATURE_INCOMPAT_FILETYPE| \
					 EXT4_FEATURE_INCOMPAT_META_BG)
#define EXT2_FEATURE_RO_COMPAT_SUPP	(EXT4_FEATURE_RO_COMPAT_SPARSE_SUPER| \
					 EXT4_FEATURE_RO_COMPAT_LARGE_FILE| \
					 EXT4_FEATURE_RO_COMPAT_BTREE_DIR)

#define EXT3_FEATURE_COMPAT_SUPP	EXT4_FEATURE_COMPAT_EXT_ATTR
#define EXT3_FEATURE_INCOMPAT_SUPP	(EXT4_FEATURE_INCOMPAT_FILETYPE| \
					 EXT4_FEATURE_INCOMPAT_RECOVER| \
					 EXT4_FEATURE_INCOMPAT_META_BG)
#define EXT3_FEATURE_RO_COMPAT_SUPP	(EXT4_FEATURE_RO_COMPAT_SPARSE_SUPER| \
					 EXT4_FEATURE_RO_COMPAT_LARGE_FILE| \
					 EXT4_FEATURE_RO_COMPAT_BTREE_DIR)

#define EXT4_FEATURE_COMPAT_SUPP	(EXT4_FEATURE_COMPAT_EXT_ATTR| \
					 EXT4_FEATURE_COMPAT_ORPHAN_FILE)
#define EXT4_FEATURE_INCOMPAT_SUPP	(EXT4_FEATURE_INCOMPAT_FILETYPE| \
					 EXT4_FEATURE_INCOMPAT_RECOVER| \
					 EXT4_FEATURE_INCOMPAT_META_BG| \
					 EXT4_FEATURE_INCOMPAT_EXTENTS| \
					 EXT4_FEATURE_INCOMPAT_64BIT| \
					 EXT4_FEATURE_INCOMPAT_FLEX_BG| \
					 EXT4_FEATURE_INCOMPAT_EA_INODE| \
					 EXT4_FEATURE_INCOMPAT_MMP | \
					 EXT4_FEATURE_INCOMPAT_INLINE_DATA | \
					 EXT4_FEATURE_INCOMPAT_ENCRYPT | \
					 EXT4_FEATURE_INCOMPAT_CASEFOLD | \
					 EXT4_FEATURE_INCOMPAT_CSUM_SEED | \
					 EXT4_FEATURE_INCOMPAT_LARGEDIR)
#define EXT4_FEATURE_RO_COMPAT_SUPP	(EXT4_FEATURE_RO_COMPAT_SPARSE_SUPER| \
					 EXT4_FEATURE_RO_COMPAT_LARGE_FILE| \
					 EXT4_FEATURE_RO_COMPAT_GDT_CSUM| \
					 EXT4_FEATURE_RO_COMPAT_DIR_NLINK | \
					 EXT4_FEATURE_RO_COMPAT_EXTRA_ISIZE | \
					 EXT4_FEATURE_RO_COMPAT_BTREE_DIR |\
					 EXT4_FEATURE_RO_COMPAT_HUGE_FILE |\
					 EXT4_FEATURE_RO_COMPAT_BIGALLOC |\
					 EXT4_FEATURE_RO_COMPAT_METADATA_CSUM|\
					 EXT4_FEATURE_RO_COMPAT_QUOTA |\
					 EXT4_FEATURE_RO_COMPAT_PROJECT |\
					 EXT4_FEATURE_RO_COMPAT_VERITY |\
					 EXT4_FEATURE_RO_COMPAT_ORPHAN_PRESENT)

#define EXTN_FEATURE_FUNCS(ver) \
static inline bool ext4_has_unknown_ext##ver##_compat_features(struct super_block *sb) \
{ \
	return ((EXT4_SB(sb)->s_es->s_feature_compat & \
		cpu_to_le32(~EXT##ver##_FEATURE_COMPAT_SUPP)) != 0); \
} \
static inline bool ext4_has_unknown_ext##ver##_ro_compat_features(struct super_block *sb) \
{ \
	return ((EXT4_SB(sb)->s_es->s_feature_ro_compat & \
		cpu_to_le32(~EXT##ver##_FEATURE_RO_COMPAT_SUPP)) != 0); \
} \
static inline bool ext4_has_unknown_ext##ver##_incompat_features(struct super_block *sb) \
{ \
	return ((EXT4_SB(sb)->s_es->s_feature_incompat & \
		cpu_to_le32(~EXT##ver##_FEATURE_INCOMPAT_SUPP)) != 0); \
}

EXTN_FEATURE_FUNCS(2)
EXTN_FEATURE_FUNCS(3)
EXTN_FEATURE_FUNCS(4)

static inline bool ext4_has_compat_features(struct super_block *sb)
{
	return (EXT4_SB(sb)->s_es->s_feature_compat != 0);
}
static inline bool ext4_has_ro_compat_features(struct super_block *sb)
{
	return (EXT4_SB(sb)->s_es->s_feature_ro_compat != 0);
}
static inline bool ext4_has_incompat_features(struct super_block *sb)
{
	return (EXT4_SB(sb)->s_es->s_feature_incompat != 0);
}

extern int ext4_feature_set_ok(struct super_block *sb, int readonly);

/*
 * Superblock flags
 */
enum {
	EXT4_FLAGS_RESIZING,	/* Avoid superblock update and resize race */
	EXT4_FLAGS_SHUTDOWN,	/* Prevent access to the file system */
	EXT4_FLAGS_BDEV_IS_DAX,	/* Current block device support DAX */
	EXT4_FLAGS_EMERGENCY_RO,/* Emergency read-only due to fs errors */
};

static inline int ext4_forced_shutdown(struct super_block *sb)
{
	return test_bit(EXT4_FLAGS_SHUTDOWN, &EXT4_SB(sb)->s_ext4_flags);
}

static inline int ext4_emergency_ro(struct super_block *sb)
{
	return test_bit(EXT4_FLAGS_EMERGENCY_RO, &EXT4_SB(sb)->s_ext4_flags);
}

static inline int ext4_emergency_state(struct super_block *sb)
{
	if (unlikely(ext4_forced_shutdown(sb)))
		return -EIO;
	if (unlikely(ext4_emergency_ro(sb)))
		return -EROFS;
	return 0;
}

/*
 * Default values for user and/or group using reserved blocks
 */
#define	EXT4_DEF_RESUID		0
#define	EXT4_DEF_RESGID		0

/*
 * Default project ID
 */
#define	EXT4_DEF_PROJID		0

#define EXT4_DEF_INODE_READAHEAD_BLKS	32

/*
 * Default mount options
 */
#define EXT4_DEFM_DEBUG		0x0001
#define EXT4_DEFM_BSDGROUPS	0x0002
#define EXT4_DEFM_XATTR_USER	0x0004
#define EXT4_DEFM_ACL		0x0008
#define EXT4_DEFM_UID16		0x0010
#define EXT4_DEFM_JMODE		0x0060
#define EXT4_DEFM_JMODE_DATA	0x0020
#define EXT4_DEFM_JMODE_ORDERED	0x0040
#define EXT4_DEFM_JMODE_WBACK	0x0060
#define EXT4_DEFM_NOBARRIER	0x0100
#define EXT4_DEFM_BLOCK_VALIDITY 0x0200
#define EXT4_DEFM_DISCARD	0x0400
#define EXT4_DEFM_NODELALLOC	0x0800

/*
 * Default journal batch times and ioprio.
 */
#define EXT4_DEF_MIN_BATCH_TIME	0
#define EXT4_DEF_MAX_BATCH_TIME	15000 /* 15ms */
#define EXT4_DEF_JOURNAL_IOPRIO (IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 3))


/*
 * Default values for superblock update
 */
#define EXT4_DEF_SB_UPDATE_INTERVAL_SEC (3600) /* seconds (1 hour) */
#define EXT4_DEF_SB_UPDATE_INTERVAL_KB (16384) /* kilobytes (16MB) */


/*
 * Minimum number of groups in a flexgroup before we separate out
 * directories into the first block group of a flexgroup
 */
#define EXT4_FLEX_SIZE_DIR_ALLOC_SCHEME	4

/*
 * Structure of a directory entry
 */
#define EXT4_NAME_LEN 255
/*
 * Base length of the ext4 directory entry excluding the name length
 */
#define EXT4_BASE_DIR_LEN (sizeof(struct ext4_dir_entry_2) - EXT4_NAME_LEN)

struct ext4_dir_entry {
	__le32	inode;			/* Inode number */
	__le16	rec_len;		/* Directory entry length */
	__le16	name_len;		/* Name length */
	char	name[EXT4_NAME_LEN];	/* File name */
};


/*
 * Encrypted Casefolded entries require saving the hash on disk. This structure
 * followed ext4_dir_entry_2's name[name_len] at the next 4 byte aligned
 * boundary.
 */
struct ext4_dir_entry_hash {
	__le32 hash;
	__le32 minor_hash;
};

/*
 * The new version of the directory entry.  Since EXT4 structures are
 * stored in intel byte order, and the name_len field could never be
 * bigger than 255 chars, it's safe to reclaim the extra byte for the
 * file_type field.
 */
struct ext4_dir_entry_2 {
	__le32	inode;			/* Inode number */
	__le16	rec_len;		/* Directory entry length */
	__u8	name_len;		/* Name length */
	__u8	file_type;		/* See file type macros EXT4_FT_* below */
	char	name[EXT4_NAME_LEN];	/* File name */
};

/*
 * Access the hashes at the end of ext4_dir_entry_2
 */
#define EXT4_DIRENT_HASHES(entry) \
	((struct ext4_dir_entry_hash *) \
		(((void *)(entry)) + \
		((8 + (entry)->name_len + EXT4_DIR_ROUND) & ~EXT4_DIR_ROUND)))
#define EXT4_DIRENT_HASH(entry) le32_to_cpu(EXT4_DIRENT_HASHES(entry)->hash)
#define EXT4_DIRENT_MINOR_HASH(entry) \
		le32_to_cpu(EXT4_DIRENT_HASHES(entry)->minor_hash)

static inline bool ext4_hash_in_dirent(const struct inode *inode)
{
	return IS_CASEFOLDED(inode) && IS_ENCRYPTED(inode);
}

/*
 * This is a bogus directory entry at the end of each leaf block that
 * records checksums.
 */
struct ext4_dir_entry_tail {
	__le32	det_reserved_zero1;	/* Pretend to be unused */
	__le16	det_rec_len;		/* 12 */
	__u8	det_reserved_zero2;	/* Zero name length */
	__u8	det_reserved_ft;	/* 0xDE, fake file type */
	__le32	det_checksum;		/* crc32c(uuid+inum+dirblock) */
};

#define EXT4_DIRENT_TAIL(block, blocksize) \
	((struct ext4_dir_entry_tail *)(((void *)(block)) + \
					((blocksize) - \
					 sizeof(struct ext4_dir_entry_tail))))

/*
 * Ext4 directory file types.  Only the low 3 bits are used.  The
 * other bits are reserved for now.
 */
#define EXT4_FT_UNKNOWN		0
#define EXT4_FT_REG_FILE	1
#define EXT4_FT_DIR		2
#define EXT4_FT_CHRDEV		3
#define EXT4_FT_BLKDEV		4
#define EXT4_FT_FIFO		5
#define EXT4_FT_SOCK		6
#define EXT4_FT_SYMLINK		7

#define EXT4_FT_MAX		8

#define EXT4_FT_DIR_CSUM	0xDE

/*
 * EXT4_DIR_PAD defines the directory entries boundaries
 *
 * NOTE: It must be a multiple of 4
 */
#define EXT4_DIR_PAD			4
#define EXT4_DIR_ROUND			(EXT4_DIR_PAD - 1)
#define EXT4_MAX_REC_LEN		((1<<16)-1)

/*
 * The rec_len is dependent on the type of directory. Directories that are
 * casefolded and encrypted need to store the hash as well, so we add room for
 * ext4_extended_dir_entry_2. For all entries related to '.' or '..' you should
 * pass NULL for dir, as those entries do not use the extra fields.
 */
static inline unsigned int ext4_dir_rec_len(__u8 name_len,
						const struct inode *dir)
{
	int rec_len = (name_len + 8 + EXT4_DIR_ROUND);

	if (dir && ext4_hash_in_dirent(dir))
		rec_len += sizeof(struct ext4_dir_entry_hash);
	return (rec_len & ~EXT4_DIR_ROUND);
}

/*
 * If we ever get support for fs block sizes > page_size, we'll need
 * to remove the #if statements in the next two functions...
 */
static inline unsigned int
ext4_rec_len_from_disk(__le16 dlen, unsigned blocksize)
{
	unsigned len = le16_to_cpu(dlen);

#if (PAGE_SIZE >= 65536)
	if (len == EXT4_MAX_REC_LEN || len == 0)
		return blocksize;
	return (len & 65532) | ((len & 3) << 16);
#else
	return len;
#endif
}

static inline __le16 ext4_rec_len_to_disk(unsigned len, unsigned blocksize)
{
	BUG_ON((len > blocksize) || (blocksize > (1 << 18)) || (len & 3));
#if (PAGE_SIZE >= 65536)
	if (len < 65536)
		return cpu_to_le16(len);
	if (len == blocksize) {
		if (blocksize == 65536)
			return cpu_to_le16(EXT4_MAX_REC_LEN);
		else
			return cpu_to_le16(0);
	}
	return cpu_to_le16((len & 65532) | ((len >> 16) & 3));
#else
	return cpu_to_le16(len);
#endif
}

/*
 * Hash Tree Directory indexing
 * (c) Daniel Phillips, 2001
 */

#define is_dx(dir) (ext4_has_feature_dir_index((dir)->i_sb) && \
		    ext4_test_inode_flag((dir), EXT4_INODE_INDEX))
#define EXT4_DIR_LINK_MAX(dir) unlikely((dir)->i_nlink >= EXT4_LINK_MAX && \
		    !(ext4_has_feature_dir_nlink((dir)->i_sb) && is_dx(dir)))
#define EXT4_DIR_LINK_EMPTY(dir) ((dir)->i_nlink == 2 || (dir)->i_nlink == 1)

/* Legal values for the dx_root hash_version field: */

#define DX_HASH_LEGACY			0
#define DX_HASH_HALF_MD4		1
#define DX_HASH_TEA			2
#define DX_HASH_LEGACY_UNSIGNED		3
#define DX_HASH_HALF_MD4_UNSIGNED	4
#define DX_HASH_TEA_UNSIGNED		5
#define DX_HASH_SIPHASH			6
#define DX_HASH_LAST 			DX_HASH_SIPHASH

static inline u32 ext4_chksum(u32 crc, const void *address, unsigned int length)
{
	return crc32c(crc, address, length);
}

#ifdef __KERNEL__

/* hash info structure used by the directory hash */
struct dx_hash_info
{
	u32		hash;
	u32		minor_hash;
	int		hash_version;
	u32		*seed;
};


/* 32 and 64 bit signed EOF for dx directories */
#define EXT4_HTREE_EOF_32BIT   ((1UL  << (32 - 1)) - 1)
#define EXT4_HTREE_EOF_64BIT   ((1ULL << (64 - 1)) - 1)


/*
 * Control parameters used by ext4_htree_next_block
 */
#define HASH_NB_ALWAYS		1

struct ext4_filename {
	const struct qstr *usr_fname;
	struct fscrypt_str disk_name;
	struct dx_hash_info hinfo;
#ifdef CONFIG_FS_ENCRYPTION
	struct fscrypt_str crypto_buf;
#endif
#if IS_ENABLED(CONFIG_UNICODE)
	struct qstr cf_name;
#endif
};

#define fname_name(p) ((p)->disk_name.name)
#define fname_usr_name(p) ((p)->usr_fname->name)
#define fname_len(p)  ((p)->disk_name.len)

/*
 * Describe an inode's exact location on disk and in memory
 */
struct ext4_iloc
{
	struct buffer_head *bh;
	unsigned long offset;
	ext4_group_t block_group;
};

static inline struct ext4_inode *ext4_raw_inode(struct ext4_iloc *iloc)
{
	return (struct ext4_inode *) (iloc->bh->b_data + iloc->offset);
}

static inline bool ext4_is_quota_file(struct inode *inode)
{
	return IS_NOQUOTA(inode) &&
	       !(EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL);
}

/*
 * This structure is stuffed into the struct file's private_data field
 * for directories.  It is where we put information so that we can do
 * readdir operations in hash tree order.
 */
struct dir_private_info {
	struct rb_root	root;
	struct rb_node	*curr_node;
	struct fname	*extra_fname;
	loff_t		last_pos;
	__u32		curr_hash;
	__u32		curr_minor_hash;
	__u32		next_hash;
	u64		cookie;
	bool		initialized;
};

/* calculate the first block number of the group */
static inline ext4_fsblk_t
ext4_group_first_block_no(struct super_block *sb, ext4_group_t group_no)
{
	return group_no * (ext4_fsblk_t)EXT4_BLOCKS_PER_GROUP(sb) +
		le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block);
}

/*
 * Special error return code only used by dx_probe() and its callers.
 */
#define ERR_BAD_DX_DIR	(-(MAX_ERRNO - 1))

/* htree levels for ext4 */
#define	EXT4_HTREE_LEVEL_COMPAT	2
#define	EXT4_HTREE_LEVEL	3

static inline int ext4_dir_htree_level(struct super_block *sb)
{
	return ext4_has_feature_largedir(sb) ?
		EXT4_HTREE_LEVEL : EXT4_HTREE_LEVEL_COMPAT;
}

/*
 * Timeout and state flag for lazy initialization inode thread.
 */
#define EXT4_DEF_LI_WAIT_MULT			10
#define EXT4_DEF_LI_MAX_START_DELAY		5
#define EXT4_LAZYINIT_QUIT			0x0001
#define EXT4_LAZYINIT_RUNNING			0x0002

/*
 * Lazy inode table initialization info
 */
struct ext4_lazy_init {
	unsigned long		li_state;
	struct list_head	li_request_list;
	struct mutex		li_list_mtx;
};

enum ext4_li_mode {
	EXT4_LI_MODE_PREFETCH_BBITMAP,
	EXT4_LI_MODE_ITABLE,
};

struct ext4_li_request {
	struct super_block	*lr_super;
	enum ext4_li_mode	lr_mode;
	ext4_group_t		lr_first_not_zeroed;
	ext4_group_t		lr_next_group;
	struct list_head	lr_request;
	unsigned long		lr_next_sched;
	unsigned long		lr_timeout;
};

struct ext4_features {
	struct kobject f_kobj;
	struct completion f_kobj_unregister;
};

/*
 * This structure will be used for multiple mount protection. It will be
 * written into the block number saved in the s_mmp_block field in the
 * superblock. Programs that check MMP should assume that if
 * SEQ_FSCK (or any unknown code above SEQ_MAX) is present then it is NOT safe
 * to use the filesystem, regardless of how old the timestamp is.
 */
#define EXT4_MMP_MAGIC     0x004D4D50U /* ASCII for MMP */
#define EXT4_MMP_SEQ_CLEAN 0xFF4D4D50U /* mmp_seq value for clean unmount */
#define EXT4_MMP_SEQ_FSCK  0xE24D4D50U /* mmp_seq value when being fscked */
#define EXT4_MMP_SEQ_MAX   0xE24D4D4FU /* maximum valid mmp_seq value */

struct mmp_struct {
	__le32	mmp_magic;		/* Magic number for MMP */
	__le32	mmp_seq;		/* Sequence no. updated periodically */

	/*
	 * mmp_time, mmp_nodename & mmp_bdevname are only used for information
	 * purposes and do not affect the correctness of the algorithm
	 */
	__le64	mmp_time;		/* Time last updated */
	char	mmp_nodename[64];	/* Node which last updated MMP block */
	char	mmp_bdevname[32];	/* Bdev which last updated MMP block */

	/*
	 * mmp_check_interval is used to verify if the MMP block has been
	 * updated on the block device. The value is updated based on the
	 * maximum time to write the MMP block during an update cycle.
	 */
	__le16	mmp_check_interval;

	__le16	mmp_pad1;
	__le32	mmp_pad2[226];
	__le32	mmp_checksum;		/* crc32c(uuid+mmp_block) */
};

/* arguments passed to the mmp thread */
struct mmpd_data {
	struct buffer_head *bh; /* bh from initial read_mmp_block() */
	struct super_block *sb;  /* super block of the fs */
};

/*
 * Check interval multiplier
 * The MMP block is written every update interval and initially checked every
 * update interval x the multiplier (the value is then adapted based on the
 * write latency). The reason is that writes can be delayed under load and we
 * don't want readers to incorrectly assume that the filesystem is no longer
 * in use.
 */
#define EXT4_MMP_CHECK_MULT		2UL

/*
 * Minimum interval for MMP checking in seconds.
 */
#define EXT4_MMP_MIN_CHECK_INTERVAL	5UL

/*
 * Maximum interval for MMP checking in seconds.
 */
#define EXT4_MMP_MAX_CHECK_INTERVAL	300UL

/*
 * Function prototypes
 */

/*
 * Ok, these declarations are also in <linux/kernel.h> but none of the
 * ext4 source programs needs to include it so they are duplicated here.
 */
# define NORET_TYPE	/**/
# define ATTRIB_NORET	__attribute__((noreturn))
# define NORET_AND	noreturn,

/* bitmap.c */
extern unsigned int ext4_count_free(char *bitmap, unsigned numchars);
void ext4_inode_bitmap_csum_set(struct super_block *sb,
				struct ext4_group_desc *gdp,
				struct buffer_head *bh);
int ext4_inode_bitmap_csum_verify(struct super_block *sb,
				  struct ext4_group_desc *gdp,
				  struct buffer_head *bh);
void ext4_block_bitmap_csum_set(struct super_block *sb,
				struct ext4_group_desc *gdp,
				struct buffer_head *bh);
int ext4_block_bitmap_csum_verify(struct super_block *sb,
				  struct ext4_group_desc *gdp,
				  struct buffer_head *bh);

/* balloc.c */
extern void ext4_get_group_no_and_offset(struct super_block *sb,
					 ext4_fsblk_t blocknr,
					 ext4_group_t *blockgrpp,
					 ext4_grpblk_t *offsetp);
extern ext4_group_t ext4_get_group_number(struct super_block *sb,
					  ext4_fsblk_t block);

extern int ext4_bg_has_super(struct super_block *sb, ext4_group_t group);
extern unsigned long ext4_bg_num_gdb(struct super_block *sb,
			ext4_group_t group);
extern ext4_fsblk_t ext4_new_meta_blocks(handle_t *handle, struct inode *inode,
					 ext4_fsblk_t goal,
					 unsigned int flags,
					 unsigned long *count,
					 int *errp);
extern int ext4_claim_free_clusters(struct ext4_sb_info *sbi,
				    s64 nclusters, unsigned int flags);
extern ext4_fsblk_t ext4_count_free_clusters(struct super_block *);
extern struct ext4_group_desc * ext4_get_group_desc(struct super_block * sb,
						    ext4_group_t block_group,
						    struct buffer_head ** bh);
extern struct ext4_group_info *ext4_get_group_info(struct super_block *sb,
						   ext4_group_t group);
extern int ext4_should_retry_alloc(struct super_block *sb, int *retries);

extern struct buffer_head *ext4_read_block_bitmap_nowait(struct super_block *sb,
						ext4_group_t block_group,
						bool ignore_locked);
extern int ext4_wait_block_bitmap(struct super_block *sb,
				  ext4_group_t block_group,
				  struct buffer_head *bh);
extern struct buffer_head *ext4_read_block_bitmap(struct super_block *sb,
						  ext4_group_t block_group);
extern unsigned ext4_free_clusters_after_init(struct super_block *sb,
					      ext4_group_t block_group,
					      struct ext4_group_desc *gdp);
ext4_fsblk_t ext4_inode_to_goal_block(struct inode *);

#if IS_ENABLED(CONFIG_UNICODE)
extern int ext4_fname_setup_ci_filename(struct inode *dir,
					const struct qstr *iname,
					struct ext4_filename *fname);

static inline void ext4_fname_free_ci_filename(struct ext4_filename *fname)
{
	kfree(fname->cf_name.name);
	fname->cf_name.name = NULL;
}
#else
static inline int ext4_fname_setup_ci_filename(struct inode *dir,
					       const struct qstr *iname,
					       struct ext4_filename *fname)
{
	return 0;
}

static inline void ext4_fname_free_ci_filename(struct ext4_filename *fname)
{
}
#endif

/* ext4 encryption related stuff goes here crypto.c */
#ifdef CONFIG_FS_ENCRYPTION
extern const struct fscrypt_operations ext4_cryptops;

int ext4_fname_setup_filename(struct inode *dir, const struct qstr *iname,
			      int lookup, struct ext4_filename *fname);

int ext4_fname_prepare_lookup(struct inode *dir, struct dentry *dentry,
			      struct ext4_filename *fname);

void ext4_fname_free_filename(struct ext4_filename *fname);

int ext4_ioctl_get_encryption_pwsalt(struct file *filp, void __user *arg);

#else /* !CONFIG_FS_ENCRYPTION */
static inline int ext4_fname_setup_filename(struct inode *dir,
					    const struct qstr *iname,
					    int lookup,
					    struct ext4_filename *fname)
{
	fname->usr_fname = iname;
	fname->disk_name.name = (unsigned char *) iname->name;
	fname->disk_name.len = iname->len;

	return ext4_fname_setup_ci_filename(dir, iname, fname);
}

static inline int ext4_fname_prepare_lookup(struct inode *dir,
					    struct dentry *dentry,
					    struct ext4_filename *fname)
{
	return ext4_fname_setup_filename(dir, &dentry->d_name, 1, fname);
}

static inline void ext4_fname_free_filename(struct ext4_filename *fname)
{
	ext4_fname_free_ci_filename(fname);
}

static inline int ext4_ioctl_get_encryption_pwsalt(struct file *filp,
						   void __user *arg)
{
	return -EOPNOTSUPP;
}
#endif /* !CONFIG_FS_ENCRYPTION */

/* dir.c */
extern int __ext4_check_dir_entry(const char *, unsigned int, struct inode *,
				  struct file *,
				  struct ext4_dir_entry_2 *,
				  struct buffer_head *, char *, int,
				  unsigned int);
#define ext4_check_dir_entry(dir, filp, de, bh, buf, size, offset) \
	unlikely(__ext4_check_dir_entry(__func__, __LINE__, (dir), (filp), \
				(de), (bh), (buf), (size), (offset)))
extern int ext4_htree_store_dirent(struct file *dir_file, __u32 hash,
				__u32 minor_hash,
				struct ext4_dir_entry_2 *dirent,
				struct fscrypt_str *ent_name);
extern void ext4_htree_free_dir_info(struct dir_private_info *p);
extern int ext4_find_dest_de(struct inode *dir, struct buffer_head *bh,
			     void *buf, int buf_size,
			     struct ext4_filename *fname,
			     struct ext4_dir_entry_2 **dest_de);
void ext4_insert_dentry(struct inode *dir, struct inode *inode,
			struct ext4_dir_entry_2 *de,
			int buf_size,
			struct ext4_filename *fname);
static inline void ext4_update_dx_flag(struct inode *inode)
{
	if (!ext4_has_feature_dir_index(inode->i_sb) &&
	    ext4_test_inode_flag(inode, EXT4_INODE_INDEX)) {
		/* ext4_iget() should have caught this... */
		WARN_ON_ONCE(ext4_has_feature_metadata_csum(inode->i_sb));
		ext4_clear_inode_flag(inode, EXT4_INODE_INDEX);
	}
}
static const unsigned char ext4_filetype_table[] = {
	DT_UNKNOWN, DT_REG, DT_DIR, DT_CHR, DT_BLK, DT_FIFO, DT_SOCK, DT_LNK
};

static inline  unsigned char get_dtype(struct super_block *sb, int filetype)
{
	if (!ext4_has_feature_filetype(sb) || filetype >= EXT4_FT_MAX)
		return DT_UNKNOWN;

	return ext4_filetype_table[filetype];
}
extern int ext4_check_all_de(struct inode *dir, struct buffer_head *bh,
			     void *buf, int buf_size);

/* fsync.c */
extern int ext4_sync_file(struct file *, loff_t, loff_t, int);

/* hash.c */
extern int ext4fs_dirhash(const struct inode *dir, const char *name, int len,
			  struct dx_hash_info *hinfo);

/* ialloc.c */
extern int ext4_mark_inode_used(struct super_block *sb, int ino);
extern struct inode *__ext4_new_inode(struct mnt_idmap *, handle_t *,
				      struct inode *, umode_t,
				      const struct qstr *qstr, __u32 goal,
				      uid_t *owner, __u32 i_flags,
				      int handle_type, unsigned int line_no,
				      int nblocks);

#define ext4_new_inode(handle, dir, mode, qstr, goal, owner, i_flags)          \
	__ext4_new_inode(&nop_mnt_idmap, (handle), (dir), (mode), (qstr),      \
			 (goal), (owner), i_flags, 0, 0, 0)
#define ext4_new_inode_start_handle(idmap, dir, mode, qstr, goal, owner, \
				    type, nblocks)		    \
	__ext4_new_inode((idmap), NULL, (dir), (mode), (qstr), (goal), (owner), \
			 0, (type), __LINE__, (nblocks))


extern void ext4_free_inode(handle_t *, struct inode *);
extern struct inode * ext4_orphan_get(struct super_block *, unsigned long);
extern unsigned long ext4_count_free_inodes(struct super_block *);
extern unsigned long ext4_count_dirs(struct super_block *);
extern void ext4_mark_bitmap_end(int start_bit, int end_bit, char *bitmap);
extern int ext4_init_inode_table(struct super_block *sb,
				 ext4_group_t group, int barrier);
extern void ext4_end_bitmap_read(struct buffer_head *bh, int uptodate);

/* fast_commit.c */
int ext4_fc_info_show(struct seq_file *seq, void *v);
void ext4_fc_init(struct super_block *sb, journal_t *journal);
void ext4_fc_init_inode(struct inode *inode);
void ext4_fc_track_range(handle_t *handle, struct inode *inode, ext4_lblk_t start,
			 ext4_lblk_t end);
void __ext4_fc_track_unlink(handle_t *handle, struct inode *inode,
	struct dentry *dentry);
void __ext4_fc_track_link(handle_t *handle, struct inode *inode,
	struct dentry *dentry);
void ext4_fc_track_unlink(handle_t *handle, struct dentry *dentry);
void ext4_fc_track_link(handle_t *handle, struct dentry *dentry);
void __ext4_fc_track_create(handle_t *handle, struct inode *inode,
			    struct dentry *dentry);
void ext4_fc_track_create(handle_t *handle, struct dentry *dentry);
void ext4_fc_track_inode(handle_t *handle, struct inode *inode);
void ext4_fc_mark_ineligible(struct super_block *sb, int reason, handle_t *handle);
void ext4_fc_del(struct inode *inode);
bool ext4_fc_replay_check_excluded(struct super_block *sb, ext4_fsblk_t block);
void ext4_fc_replay_cleanup(struct super_block *sb);
int ext4_fc_commit(journal_t *journal, tid_t commit_tid);
int __init ext4_fc_init_dentry_cache(void);
void ext4_fc_destroy_dentry_cache(void);
int ext4_fc_record_regions(struct super_block *sb, int ino,
			   ext4_lblk_t lblk, ext4_fsblk_t pblk,
			   int len, int replay);

/* mballoc.c */
extern const struct seq_operations ext4_mb_seq_groups_ops;
extern const struct seq_operations ext4_mb_seq_structs_summary_ops;
extern int ext4_seq_mb_stats_show(struct seq_file *seq, void *offset);
extern int ext4_mb_init(struct super_block *);
extern void ext4_mb_release(struct super_block *);
extern ext4_fsblk_t ext4_mb_new_blocks(handle_t *,
				struct ext4_allocation_request *, int *);
extern void ext4_discard_preallocations(struct inode *);
extern int __init ext4_init_mballoc(void);
extern void ext4_exit_mballoc(void);
extern ext4_group_t ext4_mb_prefetch(struct super_block *sb,
				     ext4_group_t group,
				     unsigned int nr, int *cnt);
extern void ext4_mb_prefetch_fini(struct super_block *sb, ext4_group_t group,
				  unsigned int nr);

extern void ext4_free_blocks(handle_t *handle, struct inode *inode,
			     struct buffer_head *bh, ext4_fsblk_t block,
			     unsigned long count, int flags);
extern int ext4_mb_alloc_groupinfo(struct super_block *sb,
				   ext4_group_t ngroups);
extern int ext4_mb_add_groupinfo(struct super_block *sb,
		ext4_group_t i, struct ext4_group_desc *desc);
extern int ext4_group_add_blocks(handle_t *handle, struct super_block *sb,
				ext4_fsblk_t block, unsigned long count);
extern int ext4_trim_fs(struct super_block *, struct fstrim_range *);
extern void ext4_process_freed_data(struct super_block *sb, tid_t commit_tid);
extern void ext4_mb_mark_bb(struct super_block *sb, ext4_fsblk_t block,
			    int len, bool state);
static inline bool ext4_mb_cr_expensive(enum criteria cr)
{
	return cr >= CR_GOAL_LEN_SLOW;
}

/* inode.c */
void ext4_inode_csum_set(struct inode *inode, struct ext4_inode *raw,
			 struct ext4_inode_info *ei);
int ext4_inode_is_fast_symlink(struct inode *inode);
void ext4_check_map_extents_env(struct inode *inode);
struct buffer_head *ext4_getblk(handle_t *, struct inode *, ext4_lblk_t, int);
struct buffer_head *ext4_bread(handle_t *, struct inode *, ext4_lblk_t, int);
int ext4_bread_batch(struct inode *inode, ext4_lblk_t block, int bh_count,
		     bool wait, struct buffer_head **bhs);
int ext4_get_block_unwritten(struct inode *inode, sector_t iblock,
			     struct buffer_head *bh_result, int create);
int ext4_get_block(struct inode *inode, sector_t iblock,
		   struct buffer_head *bh_result, int create);
int ext4_da_get_block_prep(struct inode *inode, sector_t iblock,
			   struct buffer_head *bh, int create);
int ext4_walk_page_buffers(handle_t *handle,
			   struct inode *inode,
			   struct buffer_head *head,
			   unsigned from,
			   unsigned to,
			   int *partial,
			   int (*fn)(handle_t *handle, struct inode *inode,
				     struct buffer_head *bh));
int do_journal_get_write_access(handle_t *handle, struct inode *inode,
				struct buffer_head *bh);
void ext4_set_inode_mapping_order(struct inode *inode);
#define FALL_BACK_TO_NONDELALLOC 1
#define CONVERT_INLINE_DATA	 2

typedef enum {
	EXT4_IGET_NORMAL =	0,
	EXT4_IGET_SPECIAL =	0x0001, /* OK to iget a system inode */
	EXT4_IGET_HANDLE = 	0x0002,	/* Inode # is from a handle */
	EXT4_IGET_BAD =		0x0004, /* Allow to iget a bad inode */
	EXT4_IGET_EA_INODE =	0x0008	/* Inode should contain an EA value */
} ext4_iget_flags;

extern struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
				 ext4_iget_flags flags, const char *function,
				 unsigned int line);

#define ext4_iget(sb, ino, flags) \
	__ext4_iget((sb), (ino), (flags), __func__, __LINE__)

extern int  ext4_write_inode(struct inode *, struct writeback_control *);
extern int  ext4_setattr(struct mnt_idmap *, struct dentry *,
			 struct iattr *);
extern u32  ext4_dio_alignment(struct inode *inode);
extern int  ext4_getattr(struct mnt_idmap *, const struct path *,
			 struct kstat *, u32, unsigned int);
extern void ext4_evict_inode(struct inode *);
extern void ext4_clear_inode(struct inode *);
extern int  ext4_file_getattr(struct mnt_idmap *, const struct path *,
			      struct kstat *, u32, unsigned int);
extern void ext4_dirty_inode(struct inode *, int);
extern int ext4_change_inode_journal_flag(struct inode *, int);
extern int ext4_get_inode_loc(struct inode *, struct ext4_iloc *);
extern int ext4_get_fc_inode_loc(struct super_block *sb, unsigned long ino,
			  struct ext4_iloc *iloc);
extern int ext4_inode_attach_jinode(struct inode *inode);
extern int ext4_can_truncate(struct inode *inode);
extern int ext4_truncate(struct inode *);
extern int ext4_break_layouts(struct inode *);
extern int ext4_truncate_page_cache_block_range(struct inode *inode,
						loff_t start, loff_t end);
extern int ext4_punch_hole(struct file *file, loff_t offset, loff_t length);
extern void ext4_set_inode_flags(struct inode *, bool init);
extern int ext4_alloc_da_blocks(struct inode *inode);
extern void ext4_set_aops(struct inode *inode);
extern int ext4_normal_submit_inode_data_buffers(struct jbd2_inode *jinode);
extern int ext4_chunk_trans_blocks(struct inode *, int nrblocks);
extern int ext4_chunk_trans_extent(struct inode *inode, int nrblocks);
extern int ext4_meta_trans_blocks(struct inode *inode, int lblocks,
				  int pextents);
extern int ext4_zero_partial_blocks(handle_t *handle, struct inode *inode,
			     loff_t lstart, loff_t lend);
extern vm_fault_t ext4_page_mkwrite(struct vm_fault *vmf);
extern qsize_t *ext4_get_reserved_space(struct inode *inode);
extern int ext4_get_projid(struct inode *inode, kprojid_t *projid);
extern void ext4_da_release_space(struct inode *inode, int to_free);
extern void ext4_da_update_reserve_space(struct inode *inode,
					int used, int quota_claim);
extern int ext4_issue_zeroout(struct inode *inode, ext4_lblk_t lblk,
			      ext4_fsblk_t pblk, ext4_lblk_t len);

static inline bool is_special_ino(struct super_block *sb, unsigned long ino)
{
	struct ext4_super_block *es = EXT4_SB(sb)->s_es;

	return (ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO) ||
		ino == le32_to_cpu(es->s_usr_quota_inum) ||
		ino == le32_to_cpu(es->s_grp_quota_inum) ||
		ino == le32_to_cpu(es->s_prj_quota_inum) ||
		ino == le32_to_cpu(es->s_orphan_file_inum);
}

/* indirect.c */
extern int ext4_ind_map_blocks(handle_t *handle, struct inode *inode,
				struct ext4_map_blocks *map, int flags);
extern int ext4_ind_trans_blocks(struct inode *inode, int nrblocks);
extern void ext4_ind_truncate(handle_t *, struct inode *inode);
extern int ext4_ind_remove_space(handle_t *handle, struct inode *inode,
				 ext4_lblk_t start, ext4_lblk_t end);

/* ioctl.c */
extern long ext4_ioctl(struct file *, unsigned int, unsigned long);
extern long ext4_compat_ioctl(struct file *, unsigned int, unsigned long);
int ext4_fileattr_set(struct mnt_idmap *idmap,
		      struct dentry *dentry, struct file_kattr *fa);
int ext4_fileattr_get(struct dentry *dentry, struct file_kattr *fa);
extern void ext4_reset_inode_seed(struct inode *inode);
int ext4_update_overhead(struct super_block *sb, bool force);
int ext4_force_shutdown(struct super_block *sb, u32 flags);

/* migrate.c */
extern int ext4_ext_migrate(struct inode *);
extern int ext4_ind_migrate(struct inode *inode);

/* namei.c */
extern int ext4_init_new_dir(handle_t *handle, struct inode *dir,
			     struct inode *inode);
extern int ext4_dirblock_csum_verify(struct inode *inode,
				     struct buffer_head *bh);
extern int ext4_htree_fill_tree(struct file *dir_file, __u32 start_hash,
				__u32 start_minor_hash, __u32 *next_hash);
extern int ext4_search_dir(struct buffer_head *bh,
			   char *search_buf,
			   int buf_size,
			   struct inode *dir,
			   struct ext4_filename *fname,
			   unsigned int offset,
			   struct ext4_dir_entry_2 **res_dir);
extern int ext4_generic_delete_entry(struct inode *dir,
				     struct ext4_dir_entry_2 *de_del,
				     struct buffer_head *bh,
				     void *entry_buf,
				     int buf_size,
				     int csum_size);
extern bool ext4_empty_dir(struct inode *inode);

/* resize.c */
extern void ext4_kvfree_array_rcu(void *to_free);
extern int ext4_group_add(struct super_block *sb,
				struct ext4_new_group_data *input);
extern int ext4_group_extend(struct super_block *sb,
				struct ext4_super_block *es,
				ext4_fsblk_t n_blocks_count);
extern int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count);
extern unsigned int ext4_list_backups(struct super_block *sb,
				      unsigned int *three, unsigned int *five,
				      unsigned int *seven);

/* super.c */
extern struct buffer_head *ext4_sb_bread(struct super_block *sb,
					 sector_t block, blk_opf_t op_flags);
extern struct buffer_head *ext4_sb_bread_unmovable(struct super_block *sb,
						   sector_t block);
extern void ext4_read_bh_nowait(struct buffer_head *bh, blk_opf_t op_flags,
				bh_end_io_t *end_io, bool simu_fail);
extern int ext4_read_bh(struct buffer_head *bh, blk_opf_t op_flags,
			bh_end_io_t *end_io, bool simu_fail);
extern int ext4_read_bh_lock(struct buffer_head *bh, blk_opf_t op_flags, bool wait);
extern void ext4_sb_breadahead_unmovable(struct super_block *sb, sector_t block);
extern int ext4_seq_options_show(struct seq_file *seq, void *offset);
extern int ext4_calculate_overhead(struct super_block *sb);
extern __le32 ext4_superblock_csum(struct ext4_super_block *es);
extern void ext4_superblock_csum_set(struct super_block *sb);
extern int ext4_alloc_flex_bg_array(struct super_block *sb,
				    ext4_group_t ngroup);
extern const char *ext4_decode_error(struct super_block *sb, int errno,
				     char nbuf[16]);
extern void ext4_mark_group_bitmap_corrupted(struct super_block *sb,
					     ext4_group_t block_group,
					     unsigned int flags);
extern unsigned int ext4_num_base_meta_blocks(struct super_block *sb,
					      ext4_group_t block_group);

extern __printf(7, 8)
void __ext4_error(struct super_block *, const char *, unsigned int, bool,
		  int, __u64, const char *, ...);
extern __printf(6, 7)
void __ext4_error_inode(struct inode *, const char *, unsigned int,
			ext4_fsblk_t, int, const char *, ...);
extern __printf(5, 6)
void __ext4_error_file(struct file *, const char *, unsigned int, ext4_fsblk_t,
		     const char *, ...);
extern void __ext4_std_error(struct super_block *, const char *,
			     unsigned int, int);
extern __printf(4, 5)
void __ext4_warning(struct super_block *, const char *, unsigned int,
		    const char *, ...);
extern __printf(4, 5)
void __ext4_warning_inode(const struct inode *inode, const char *function,
			  unsigned int line, const char *fmt, ...);
extern __printf(3, 4)
void __ext4_msg(struct super_block *, const char *, const char *, ...);
extern void __dump_mmp_msg(struct super_block *, struct mmp_struct *mmp,
			   const char *, unsigned int, const char *);
extern __printf(7, 8)
void __ext4_grp_locked_error(const char *, unsigned int,
			     struct super_block *, ext4_group_t,
			     unsigned long, ext4_fsblk_t,
			     const char *, ...);

#define EXT4_ERROR_INODE(inode, fmt, a...) \
	ext4_error_inode((inode), __func__, __LINE__, 0, (fmt), ## a)

#define EXT4_ERROR_INODE_ERR(inode, err, fmt, a...)			\
	__ext4_error_inode((inode), __func__, __LINE__, 0, (err), (fmt), ## a)

#define ext4_error_inode_block(inode, block, err, fmt, a...)		\
	__ext4_error_inode((inode), __func__, __LINE__, (block), (err),	\
			   (fmt), ## a)

#define EXT4_ERROR_FILE(file, block, fmt, a...)				\
	ext4_error_file((file), __func__, __LINE__, (block), (fmt), ## a)

#define ext4_abort(sb, err, fmt, a...)					\
	__ext4_error((sb), __func__, __LINE__, true, (err), 0, (fmt), ## a)

#ifdef CONFIG_PRINTK

#define ext4_error_inode(inode, func, line, block, fmt, ...)		\
	__ext4_error_inode(inode, func, line, block, 0, fmt, ##__VA_ARGS__)
#define ext4_error_inode_err(inode, func, line, block, err, fmt, ...)	\
	__ext4_error_inode((inode), (func), (line), (block), 		\
			   (err), (fmt), ##__VA_ARGS__)
#define ext4_error_file(file, func, line, block, fmt, ...)		\
	__ext4_error_file(file, func, line, block, fmt, ##__VA_ARGS__)
#define ext4_error(sb, fmt, ...)					\
	__ext4_error((sb), __func__, __LINE__, false, 0, 0, (fmt),	\
		##__VA_ARGS__)
#define ext4_error_err(sb, err, fmt, ...)				\
	__ext4_error((sb), __func__, __LINE__, false, (err), 0, (fmt),	\
		##__VA_ARGS__)
#define ext4_warning(sb, fmt, ...)					\
	__ext4_warning(sb, __func__, __LINE__, fmt, ##__VA_ARGS__)
#define ext4_warning_inode(inode, fmt, ...)				\
	__ext4_warning_inode(inode, __func__, __LINE__, fmt, ##__VA_ARGS__)
#define ext4_msg(sb, level, fmt, ...)				\
	__ext4_msg(sb, level, fmt, ##__VA_ARGS__)
#define dump_mmp_msg(sb, mmp, msg)					\
	__dump_mmp_msg(sb, mmp, __func__, __LINE__, msg)
#define ext4_grp_locked_error(sb, grp, ino, block, fmt, ...)		\
	__ext4_grp_locked_error(__func__, __LINE__, sb, grp, ino, block, \
				fmt, ##__VA_ARGS__)

#else

#define ext4_error_inode(inode, func, line, block, fmt, ...)		\
do {									\
	no_printk(fmt, ##__VA_ARGS__);					\
	__ext4_error_inode(inode, "", 0, block, 0, " ");		\
} while (0)
#define ext4_error_inode_err(inode, func, line, block, err, fmt, ...)	\
do {									\
	no_printk(fmt, ##__VA_ARGS__);					\
	__ext4_error_inode(inode, "", 0, block, err, " ");		\
} while (0)
#define ext4_error_file(file, func, line, block, fmt, ...)		\
do {									\
	no_printk(fmt, ##__VA_ARGS__);					\
	__ext4_error_file(file, "", 0, block, " ");			\
} while (0)
#define ext4_error(sb, fmt, ...)					\
do {									\
	no_printk(fmt, ##__VA_ARGS__);					\
	__ext4_error(sb, "", 0, false, 0, 0, " ");			\
} while (0)
#define ext4_error_err(sb, err, fmt, ...)				\
do {									\
	no_printk(fmt, ##__VA_ARGS__);					\
	__ext4_error(sb, "", 0, false, err, 0, " ");			\
} while (0)
#define ext4_warning(sb, fmt, ...)					\
do {									\
	no_printk(fmt, ##__VA_ARGS__);					\
	__ext4_warning(sb, "", 0, " ");					\
} while (0)
#define ext4_warning_inode(inode, fmt, ...)				\
do {									\
	no_printk(fmt, ##__VA_ARGS__);					\
	__ext4_warning_inode(inode, "", 0, " ");			\
} while (0)
#define ext4_msg(sb, level, fmt, ...)					\
do {									\
	no_printk(fmt, ##__VA_ARGS__);					\
	__ext4_msg(sb, "", " ");					\
} while (0)
#define dump_mmp_msg(sb, mmp, msg)					\
	__dump_mmp_msg(sb, mmp, "", 0, "")
#define ext4_grp_locked_error(sb, grp, ino, block, fmt, ...)		\
do {									\
	no_printk(fmt, ##__VA_ARGS__);				\
	__ext4_grp_locked_error("", 0, sb, grp, ino, block, " ");	\
} while (0)

#endif

extern ext4_fsblk_t ext4_block_bitmap(struct super_block *sb,
				      struct ext4_group_desc *bg);
extern ext4_fsblk_t ext4_inode_bitmap(struct super_block *sb,
				      struct ext4_group_desc *bg);
extern ext4_fsblk_t ext4_inode_table(struct super_block *sb,
				     struct ext4_group_desc *bg);
extern __u32 ext4_free_group_clusters(struct super_block *sb,
				      struct ext4_group_desc *bg);
extern __u32 ext4_free_inodes_count(struct super_block *sb,
				 struct ext4_group_desc *bg);
extern __u32 ext4_used_dirs_count(struct super_block *sb,
				struct ext4_group_desc *bg);
extern __u32 ext4_itable_unused_count(struct super_block *sb,
				   struct ext4_group_desc *bg);
extern void ext4_block_bitmap_set(struct super_block *sb,
				  struct ext4_group_desc *bg, ext4_fsblk_t blk);
extern void ext4_inode_bitmap_set(struct super_block *sb,
				  struct ext4_group_desc *bg, ext4_fsblk_t blk);
extern void ext4_inode_table_set(struct super_block *sb,
				 struct ext4_group_desc *bg, ext4_fsblk_t blk);
extern void ext4_free_group_clusters_set(struct super_block *sb,
					 struct ext4_group_desc *bg,
					 __u32 count);
extern void ext4_free_inodes_set(struct super_block *sb,
				struct ext4_group_desc *bg, __u32 count);
extern void ext4_used_dirs_set(struct super_block *sb,
				struct ext4_group_desc *bg, __u32 count);
extern void ext4_itable_unused_set(struct super_block *sb,
				   struct ext4_group_desc *bg, __u32 count);
extern int ext4_group_desc_csum_verify(struct super_block *sb, __u32 group,
				       struct ext4_group_desc *gdp);
extern void ext4_group_desc_csum_set(struct super_block *sb, __u32 group,
				     struct ext4_group_desc *gdp);
extern int ext4_register_li_request(struct super_block *sb,
				    ext4_group_t first_not_zeroed);

static inline int ext4_has_group_desc_csum(struct super_block *sb)
{
	return ext4_has_feature_gdt_csum(sb) ||
	       ext4_has_feature_metadata_csum(sb);
}

#define ext4_read_incompat_64bit_val(es, name) \
	(((es)->s_feature_incompat & cpu_to_le32(EXT4_FEATURE_INCOMPAT_64BIT) \
		? (ext4_fsblk_t)le32_to_cpu(es->name##_hi) << 32 : 0) | \
		le32_to_cpu(es->name##_lo))

static inline ext4_fsblk_t ext4_blocks_count(struct ext4_super_block *es)
{
	return ext4_read_incompat_64bit_val(es, s_blocks_count);
}

static inline ext4_fsblk_t ext4_r_blocks_count(struct ext4_super_block *es)
{
	return ext4_read_incompat_64bit_val(es, s_r_blocks_count);
}

static inline ext4_fsblk_t ext4_free_blocks_count(struct ext4_super_block *es)
{
	return ext4_read_incompat_64bit_val(es, s_free_blocks_count);
}

static inline void ext4_blocks_count_set(struct ext4_super_block *es,
					 ext4_fsblk_t blk)
{
	es->s_blocks_count_lo = cpu_to_le32((u32)blk);
	es->s_blocks_count_hi = cpu_to_le32(blk >> 32);
}

static inline void ext4_free_blocks_count_set(struct ext4_super_block *es,
					      ext4_fsblk_t blk)
{
	es->s_free_blocks_count_lo = cpu_to_le32((u32)blk);
	es->s_free_blocks_count_hi = cpu_to_le32(blk >> 32);
}

static inline void ext4_r_blocks_count_set(struct ext4_super_block *es,
					   ext4_fsblk_t blk)
{
	es->s_r_blocks_count_lo = cpu_to_le32((u32)blk);
	es->s_r_blocks_count_hi = cpu_to_le32(blk >> 32);
}

static inline loff_t ext4_isize(struct super_block *sb,
				struct ext4_inode *raw_inode)
{
	if (ext4_has_feature_largedir(sb) ||
	    S_ISREG(le16_to_cpu(raw_inode->i_mode)))
		return ((loff_t)le32_to_cpu(raw_inode->i_size_high) << 32) |
			le32_to_cpu(raw_inode->i_size_lo);

	return (loff_t) le32_to_cpu(raw_inode->i_size_lo);
}

static inline void ext4_isize_set(struct ext4_inode *raw_inode, loff_t i_size)
{
	raw_inode->i_size_lo = cpu_to_le32(i_size);
	raw_inode->i_size_high = cpu_to_le32(i_size >> 32);
}

/*
 * Reading s_groups_count requires using smp_rmb() afterwards.  See
 * the locking protocol documented in the comments of ext4_group_add()
 * in resize.c
 */
static inline ext4_group_t ext4_get_groups_count(struct super_block *sb)
{
	ext4_group_t	ngroups = EXT4_SB(sb)->s_groups_count;

	smp_rmb();
	return ngroups;
}

static inline ext4_group_t ext4_flex_group(struct ext4_sb_info *sbi,
					     ext4_group_t block_group)
{
	return block_group >> sbi->s_log_groups_per_flex;
}

static inline unsigned int ext4_flex_bg_size(struct ext4_sb_info *sbi)
{
	return 1 << sbi->s_log_groups_per_flex;
}

static inline loff_t ext4_get_maxbytes(struct inode *inode)
{
	if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))
		return inode->i_sb->s_maxbytes;
	return EXT4_SB(inode->i_sb)->s_bitmap_maxbytes;
}

#define ext4_std_error(sb, errno)				\
do {								\
	if ((errno))						\
		__ext4_std_error((sb), __func__, __LINE__, (errno));	\
} while (0)

#ifdef CONFIG_SMP
/* Each CPU can accumulate percpu_counter_batch clusters in their local
 * counters. So we need to make sure we have free clusters more
 * than percpu_counter_batch  * nr_cpu_ids. Also add a window of 4 times.
 */
#define EXT4_FREECLUSTERS_WATERMARK (4 * (percpu_counter_batch * nr_cpu_ids))
#else
#define EXT4_FREECLUSTERS_WATERMARK 0
#endif

/* Update i_disksize. Requires i_rwsem to avoid races with truncate */
static inline void ext4_update_i_disksize(struct inode *inode, loff_t newsize)
{
	WARN_ON_ONCE(S_ISREG(inode->i_mode) &&
		     !inode_is_locked(inode));
	down_write(&EXT4_I(inode)->i_data_sem);
	if (newsize > EXT4_I(inode)->i_disksize)
		WRITE_ONCE(EXT4_I(inode)->i_disksize, newsize);
	up_write(&EXT4_I(inode)->i_data_sem);
}

/* Update i_size, i_disksize. Requires i_rwsem to avoid races with truncate */
static inline int ext4_update_inode_size(struct inode *inode, loff_t newsize)
{
	int changed = 0;

	if (newsize > inode->i_size) {
		i_size_write(inode, newsize);
		changed = 1;
	}
	if (newsize > EXT4_I(inode)->i_disksize) {
		ext4_update_i_disksize(inode, newsize);
		changed |= 2;
	}
	return changed;
}

int ext4_update_disksize_before_punch(struct inode *inode, loff_t offset,
				      loff_t len);

struct ext4_group_info {
	unsigned long   bb_state;
#ifdef AGGRESSIVE_CHECK
	unsigned long	bb_check_counter;
#endif
	struct rb_root  bb_free_root;
	ext4_grpblk_t	bb_first_free;	/* first free block */
	ext4_grpblk_t	bb_free;	/* total free blocks */
	ext4_grpblk_t	bb_fragments;	/* nr of freespace fragments */
	int		bb_avg_fragment_size_order;	/* order of average
							   fragment in BG */
	ext4_grpblk_t	bb_largest_free_order;/* order of largest frag in BG */
	ext4_group_t	bb_group;	/* Group number */
	struct          list_head bb_prealloc_list;
#ifdef DOUBLE_CHECK
	void            *bb_bitmap;
#endif
	struct rw_semaphore alloc_sem;
	ext4_grpblk_t	bb_counters[];	/* Nr of free power-of-two-block
					 * regions, index is order.
					 * bb_counters[3] = 5 means
					 * 5 free 8-block regions. */
};

#define EXT4_GROUP_INFO_NEED_INIT_BIT		0
#define EXT4_GROUP_INFO_WAS_TRIMMED_BIT		1
#define EXT4_GROUP_INFO_BBITMAP_CORRUPT_BIT	2
#define EXT4_GROUP_INFO_IBITMAP_CORRUPT_BIT	3
#define EXT4_GROUP_INFO_BBITMAP_CORRUPT		\
	(1 << EXT4_GROUP_INFO_BBITMAP_CORRUPT_BIT)
#define EXT4_GROUP_INFO_IBITMAP_CORRUPT		\
	(1 << EXT4_GROUP_INFO_IBITMAP_CORRUPT_BIT)
#define EXT4_GROUP_INFO_BBITMAP_READ_BIT	4

#define EXT4_MB_GRP_NEED_INIT(grp)	\
	(test_bit(EXT4_GROUP_INFO_NEED_INIT_BIT, &((grp)->bb_state)))
#define EXT4_MB_GRP_BBITMAP_CORRUPT(grp)	\
	(test_bit(EXT4_GROUP_INFO_BBITMAP_CORRUPT_BIT, &((grp)->bb_state)))
#define EXT4_MB_GRP_IBITMAP_CORRUPT(grp)	\
	(test_bit(EXT4_GROUP_INFO_IBITMAP_CORRUPT_BIT, &((grp)->bb_state)))

#define EXT4_MB_GRP_WAS_TRIMMED(grp)	\
	(test_bit(EXT4_GROUP_INFO_WAS_TRIMMED_BIT, &((grp)->bb_state)))
#define EXT4_MB_GRP_SET_TRIMMED(grp)	\
	(set_bit(EXT4_GROUP_INFO_WAS_TRIMMED_BIT, &((grp)->bb_state)))
#define EXT4_MB_GRP_CLEAR_TRIMMED(grp)	\
	(clear_bit(EXT4_GROUP_INFO_WAS_TRIMMED_BIT, &((grp)->bb_state)))
#define EXT4_MB_GRP_TEST_AND_SET_READ(grp)	\
	(test_and_set_bit(EXT4_GROUP_INFO_BBITMAP_READ_BIT, &((grp)->bb_state)))

#define EXT4_MAX_CONTENTION		8
#define EXT4_CONTENTION_THRESHOLD	2

static inline spinlock_t *ext4_group_lock_ptr(struct super_block *sb,
					      ext4_group_t group)
{
	return bgl_lock_ptr(EXT4_SB(sb)->s_blockgroup_lock, group);
}

/*
 * Returns true if the filesystem is busy enough that attempts to
 * access the block group locks has run into contention.
 */
static inline int ext4_fs_is_busy(struct ext4_sb_info *sbi)
{
	return (atomic_read(&sbi->s_lock_busy) > EXT4_CONTENTION_THRESHOLD);
}

static inline bool ext4_try_lock_group(struct super_block *sb, ext4_group_t group)
{
	if (!spin_trylock(ext4_group_lock_ptr(sb, group)))
		return false;
	/*
	 * We're able to grab the lock right away, so drop the lock
	 * contention counter.
	 */
	atomic_add_unless(&EXT4_SB(sb)->s_lock_busy, -1, 0);
	return true;
}

static inline void ext4_lock_group(struct super_block *sb, ext4_group_t group)
{
	if (!ext4_try_lock_group(sb, group)) {
		/*
		 * The lock is busy, so bump the contention counter,
		 * and then wait on the spin lock.
		 */
		atomic_add_unless(&EXT4_SB(sb)->s_lock_busy, 1,
				  EXT4_MAX_CONTENTION);
		spin_lock(ext4_group_lock_ptr(sb, group));
	}
}

static inline void ext4_unlock_group(struct super_block *sb,
					ext4_group_t group)
{
	spin_unlock(ext4_group_lock_ptr(sb, group));
}

#ifdef CONFIG_QUOTA
static inline bool ext4_quota_capable(struct super_block *sb)
{
	return (test_opt(sb, QUOTA) || ext4_has_feature_quota(sb));
}

static inline bool ext4_is_quota_journalled(struct super_block *sb)
{
	struct ext4_sb_info *sbi = EXT4_SB(sb);

	return (ext4_has_feature_quota(sb) ||
		sbi->s_qf_names[USRQUOTA] || sbi->s_qf_names[GRPQUOTA]);
}
int ext4_enable_quotas(struct super_block *sb);
#endif

/*
 * Block validity checking
 */
#define ext4_check_indirect_blockref(inode, bh)				\
	ext4_check_blockref(__func__, __LINE__, inode,			\
			    (__le32 *)(bh)->b_data,			\
			    EXT4_ADDR_PER_BLOCK((inode)->i_sb))

#define ext4_ind_check_inode(inode)					\
	ext4_check_blockref(__func__, __LINE__, inode,			\
			    EXT4_I(inode)->i_data,			\
			    EXT4_NDIR_BLOCKS)

/*
 * Inodes and files operations
 */

/* dir.c */
extern const struct file_operations ext4_dir_operations;

/* file.c */
extern const struct inode_operations ext4_file_inode_operations;
extern const struct file_operations ext4_file_operations;
extern loff_t ext4_llseek(struct file *file, loff_t offset, int origin);

/* inline.c */
extern int ext4_get_max_inline_size(struct inode *inode);
extern int ext4_find_inline_data_nolock(struct inode *inode);
extern int ext4_destroy_inline_data(handle_t *handle, struct inode *inode);
extern void ext4_update_final_de(void *de_buf, int old_size, int new_size);

int ext4_readpage_inline(struct inode *inode, struct folio *folio);
extern int ext4_try_to_write_inline_data(struct address_space *mapping,
					 struct inode *inode,
					 loff_t pos, unsigned len,
					 struct folio **foliop);
int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len,
			       unsigned copied, struct folio *folio);
extern int ext4_generic_write_inline_data(struct address_space *mapping,
					  struct inode *inode,
					  loff_t pos, unsigned len,
					  struct folio **foliop,
					  void **fsdata, bool da);
extern int ext4_try_add_inline_entry(handle_t *handle,
				     struct ext4_filename *fname,
				     struct inode *dir, struct inode *inode);
extern int ext4_try_create_inline_dir(handle_t *handle,
				      struct inode *parent,
				      struct inode *inode);
extern int ext4_read_inline_dir(struct file *filp,
				struct dir_context *ctx,
				int *has_inline_data);
extern int ext4_inlinedir_to_tree(struct file *dir_file,
				  struct inode *dir, ext4_lblk_t block,
				  struct dx_hash_info *hinfo,
				  __u32 start_hash, __u32 start_minor_hash,
				  int *has_inline_data);
extern struct buffer_head *ext4_find_inline_entry(struct inode *dir,
					struct ext4_filename *fname,
					struct ext4_dir_entry_2 **res_dir,
					int *has_inline_data);
extern int ext4_delete_inline_entry(handle_t *handle,
				    struct inode *dir,
				    struct ext4_dir_entry_2 *de_del,
				    struct buffer_head *bh,
				    int *has_inline_data);
extern bool empty_inline_dir(struct inode *dir, int *has_inline_data);
extern struct buffer_head *ext4_get_first_inline_block(struct inode *inode,
					struct ext4_dir_entry_2 **parent_de,
					int *retval);
extern void *ext4_read_inline_link(struct inode *inode);

struct iomap;
extern int ext4_inline_data_iomap(struct inode *inode, struct iomap *iomap);

extern int ext4_inline_data_truncate(struct inode *inode, int *has_inline);

extern int ext4_convert_inline_data(struct inode *inode);

static inline int ext4_has_inline_data(struct inode *inode)
{
	return ext4_test_inode_flag(inode, EXT4_INODE_INLINE_DATA) &&
	       EXT4_I(inode)->i_inline_off;
}

/* namei.c */
extern const struct inode_operations ext4_dir_inode_operations;
extern const struct inode_operations ext4_special_inode_operations;
extern struct dentry *ext4_get_parent(struct dentry *child);
extern int ext4_init_dirblock(handle_t *handle, struct inode *inode,
			      struct buffer_head *dir_block,
			      unsigned int parent_ino, void *inline_buf,
			      int inline_size);
extern void ext4_initialize_dirent_tail(struct buffer_head *bh,
					unsigned int blocksize);
extern int ext4_handle_dirty_dirblock(handle_t *handle, struct inode *inode,
				      struct buffer_head *bh);
extern int __ext4_unlink(struct inode *dir, const struct qstr *d_name,
			 struct inode *inode, struct dentry *dentry);
extern int __ext4_link(struct inode *dir, struct inode *inode,
		       struct dentry *dentry);

#define S_SHIFT 12
static const unsigned char ext4_type_by_mode[(S_IFMT >> S_SHIFT) + 1] = {
	[S_IFREG >> S_SHIFT]	= EXT4_FT_REG_FILE,
	[S_IFDIR >> S_SHIFT]	= EXT4_FT_DIR,
	[S_IFCHR >> S_SHIFT]	= EXT4_FT_CHRDEV,
	[S_IFBLK >> S_SHIFT]	= EXT4_FT_BLKDEV,
	[S_IFIFO >> S_SHIFT]	= EXT4_FT_FIFO,
	[S_IFSOCK >> S_SHIFT]	= EXT4_FT_SOCK,
	[S_IFLNK >> S_SHIFT]	= EXT4_FT_SYMLINK,
};

static inline void ext4_set_de_type(struct super_block *sb,
				struct ext4_dir_entry_2 *de,
				umode_t mode) {
	if (ext4_has_feature_filetype(sb))
		de->file_type = ext4_type_by_mode[(mode & S_IFMT)>>S_SHIFT];
}

/* readpages.c */
extern int ext4_mpage_readpages(struct inode *inode,
		struct readahead_control *rac, struct folio *folio);
extern int __init ext4_init_post_read_processing(void);
extern void ext4_exit_post_read_processing(void);

/* symlink.c */
extern const struct inode_operations ext4_encrypted_symlink_inode_operations;
extern const struct inode_operations ext4_symlink_inode_operations;
extern const struct inode_operations ext4_fast_symlink_inode_operations;

/* sysfs.c */
extern void ext4_notify_error_sysfs(struct ext4_sb_info *sbi);
extern int ext4_register_sysfs(struct super_block *sb);
extern void ext4_unregister_sysfs(struct super_block *sb);
extern int __init ext4_init_sysfs(void);
extern void ext4_exit_sysfs(void);

/* block_validity */
extern void ext4_release_system_zone(struct super_block *sb);
extern int ext4_setup_system_zone(struct super_block *sb);
extern int __init ext4_init_system_zone(void);
extern void ext4_exit_system_zone(void);
extern int ext4_inode_block_valid(struct inode *inode,
				  ext4_fsblk_t start_blk,
				  unsigned int count);
extern int ext4_check_blockref(const char *, unsigned int,
			       struct inode *, __le32 *, unsigned int);
extern int ext4_sb_block_valid(struct super_block *sb, struct inode *inode,
				ext4_fsblk_t start_blk, unsigned int count);


/* extents.c */
struct ext4_ext_path;
struct ext4_extent;

/*
 * Maximum number of logical blocks in a file; ext4_extent's ee_block is
 * __le32.
 */
#define EXT_MAX_BLOCKS	0xffffffff

extern void ext4_ext_tree_init(handle_t *handle, struct inode *inode);
extern int ext4_ext_index_trans_blocks(struct inode *inode, int extents);
extern int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
			       struct ext4_map_blocks *map, int flags);
extern int ext4_ext_truncate(handle_t *, struct inode *);
extern int ext4_ext_remove_space(struct inode *inode, ext4_lblk_t start,
				 ext4_lblk_t end);
extern void ext4_ext_init(struct super_block *);
extern void ext4_ext_release(struct super_block *);
extern long ext4_fallocate(struct file *file, int mode, loff_t offset,
			  loff_t len);
extern int ext4_convert_unwritten_extents(handle_t *handle, struct inode *inode,
					  loff_t offset, ssize_t len);
extern int ext4_convert_unwritten_extents_atomic(handle_t *handle,
			struct inode *inode, loff_t offset, ssize_t len);
extern int ext4_convert_unwritten_io_end_vec(handle_t *handle,
					     ext4_io_end_t *io_end);
extern int ext4_map_blocks(handle_t *handle, struct inode *inode,
			   struct ext4_map_blocks *map, int flags);
extern int ext4_ext_calc_credits_for_single_extent(struct inode *inode,
						   int num,
						   struct ext4_ext_path *path);
extern struct ext4_ext_path *ext4_ext_insert_extent(
				handle_t *handle, struct inode *inode,
				struct ext4_ext_path *path,
				struct ext4_extent *newext, int gb_flags);
extern struct ext4_ext_path *ext4_find_extent(struct inode *, ext4_lblk_t,
					      struct ext4_ext_path *,
					      int flags);
extern void ext4_free_ext_path(struct ext4_ext_path *);
extern int ext4_ext_check_inode(struct inode *inode);
extern ext4_lblk_t ext4_ext_next_allocated_block(struct ext4_ext_path *path);
extern int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
			__u64 start, __u64 len);
extern int ext4_get_es_cache(struct inode *inode,
			     struct fiemap_extent_info *fieinfo,
			     __u64 start, __u64 len);
extern int ext4_ext_precache(struct inode *inode);
extern int ext4_swap_extents(handle_t *handle, struct inode *inode1,
				struct inode *inode2, ext4_lblk_t lblk1,
			     ext4_lblk_t lblk2,  ext4_lblk_t count,
			     int mark_unwritten,int *err);
extern int ext4_clu_mapped(struct inode *inode, ext4_lblk_t lclu);
extern int ext4_datasem_ensure_credits(handle_t *handle, struct inode *inode,
				       int check_cred, int restart_cred,
				       int revoke_cred);
extern void ext4_ext_replay_shrink_inode(struct inode *inode, ext4_lblk_t end);
extern int ext4_ext_replay_set_iblocks(struct inode *inode);
extern int ext4_ext_replay_update_ex(struct inode *inode, ext4_lblk_t start,
		int len, int unwritten, ext4_fsblk_t pblk);
extern int ext4_ext_clear_bb(struct inode *inode);


/* move_extent.c */
extern void ext4_double_down_write_data_sem(struct inode *first,
					    struct inode *second);
extern void ext4_double_up_write_data_sem(struct inode *orig_inode,
					  struct inode *donor_inode);
extern int ext4_move_extents(struct file *o_filp, struct file *d_filp,
			     __u64 start_orig, __u64 start_donor,
			     __u64 len, __u64 *moved_len);

/* page-io.c */
extern int __init ext4_init_pageio(void);
extern void ext4_exit_pageio(void);
extern ext4_io_end_t *ext4_init_io_end(struct inode *inode, gfp_t flags);
extern ext4_io_end_t *ext4_get_io_end(ext4_io_end_t *io_end);
extern int ext4_put_io_end(ext4_io_end_t *io_end);
extern void ext4_put_io_end_defer(ext4_io_end_t *io_end);
extern void ext4_io_submit_init(struct ext4_io_submit *io,
				struct writeback_control *wbc);
extern void ext4_end_io_rsv_work(struct work_struct *work);
extern void ext4_io_submit(struct ext4_io_submit *io);
int ext4_bio_write_folio(struct ext4_io_submit *io, struct folio *page,
		size_t len);
extern struct ext4_io_end_vec *ext4_alloc_io_end_vec(ext4_io_end_t *io_end);
extern struct ext4_io_end_vec *ext4_last_io_end_vec(ext4_io_end_t *io_end);

/* mmp.c */
extern int ext4_multi_mount_protect(struct super_block *, ext4_fsblk_t);

/* mmp.c */
extern void ext4_stop_mmpd(struct ext4_sb_info *sbi);

/* verity.c */
extern const struct fsverity_operations ext4_verityops;

/* orphan.c */
extern int ext4_orphan_add(handle_t *, struct inode *);
extern int ext4_orphan_del(handle_t *, struct inode *);
extern void ext4_orphan_cleanup(struct super_block *sb,
				struct ext4_super_block *es);
extern void ext4_release_orphan_info(struct super_block *sb);
extern int ext4_init_orphan_info(struct super_block *sb);
extern int ext4_orphan_file_empty(struct super_block *sb);
extern void ext4_orphan_file_block_trigger(
				struct jbd2_buffer_trigger_type *triggers,
				struct buffer_head *bh,
				void *data, size_t size);

/*
 * Add new method to test whether block and inode bitmaps are properly
 * initialized. With uninit_bg reading the block from disk is not enough
 * to mark the bitmap uptodate. We need to also zero-out the bitmap
 */
#define BH_BITMAP_UPTODATE BH_JBDPrivateStart

static inline int bitmap_uptodate(struct buffer_head *bh)
{
	return (buffer_uptodate(bh) &&
			test_bit(BH_BITMAP_UPTODATE, &(bh)->b_state));
}
static inline void set_bitmap_uptodate(struct buffer_head *bh)
{
	set_bit(BH_BITMAP_UPTODATE, &(bh)->b_state);
}

extern int ext4_resize_begin(struct super_block *sb);
extern int ext4_resize_end(struct super_block *sb, bool update_backups);

static inline void ext4_set_io_unwritten_flag(struct ext4_io_end *io_end)
{
	if (!(io_end->flag & EXT4_IO_END_UNWRITTEN))
		io_end->flag |= EXT4_IO_END_UNWRITTEN;
}

static inline void ext4_clear_io_unwritten_flag(ext4_io_end_t *io_end)
{
	if (io_end->flag & EXT4_IO_END_UNWRITTEN)
		io_end->flag &= ~EXT4_IO_END_UNWRITTEN;
}

extern const struct iomap_ops ext4_iomap_ops;
extern const struct iomap_ops ext4_iomap_overwrite_ops;
extern const struct iomap_ops ext4_iomap_report_ops;

static inline int ext4_buffer_uptodate(struct buffer_head *bh)
{
	/*
	 * If the buffer has the write error flag, we have failed
	 * to write out data in the block.  In this  case, we don't
	 * have to read the block because we may read the old data
	 * successfully.
	 */
	if (buffer_write_io_error(bh))
		set_buffer_uptodate(bh);
	return buffer_uptodate(bh);
}

static inline bool ext4_inode_can_atomic_write(struct inode *inode)
{

	return S_ISREG(inode->i_mode) &&
		ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS) &&
		EXT4_SB(inode->i_sb)->s_awu_min > 0;
}

extern int ext4_block_write_begin(handle_t *handle, struct folio *folio,
				  loff_t pos, unsigned len,
				  get_block_t *get_block);
#endif	/* __KERNEL__ */

#define EFSBADCRC	EBADMSG		/* Bad CRC detected */
#define EFSCORRUPTED	EUCLEAN		/* Filesystem is corrupted */

#endif	/* _EXT4_H */
]

gemini-3.1-pro-preview

							input: 138856
							output: 44
							thoughts: 9196
						

**Lockdep Investigation: EA Inode Truncation via do_unlinkat**

Alright, let's break this down. It seems the lockdep is flagging a dependency issue during a file truncation, specifically related to extended attributes (EA) inodes. The key here is the `&ei->i_data_sem/3` lock class, which indicates an EA inode. We need to figure out how `ext4_truncate`, which operates on an EA inode, is being called from `do_unlinkat`, which *shouldn't* be directly truncating EA inodes based on how the filesystem is supposed to work.

The starting point is `EXT4_FL_USER_MODIFIABLE` flags. I first confirmed that `EXT4_EA_INODE_FL` (which marks an inode as an EA inode) isn't in that set. This means a user can't directly manipulate this flag, so it's a kernel-managed property. The reproducer calls `setxattr`, which should create a *new* EA inode. This EA inode isn't directly linked into the directory entry, which is the key here.

The lockdep report points to `ext4_truncate` on the EA inode, which means the inode with `&ei->i_data_sem/3` is an EA inode. The lockdep shows: `do_unlinkat` -> `evict` -> `ext4_evict_inode` -> `ext4_truncate`. This looks like the right path, but it suggests `evict` (called from `iput` due to the file being unlinked) directly calls `ext4_truncate` (on the EA inode), which is strange since there is no `ext4_xattr_delete_inode` in the trace. However, the stack trace can be incomplete, so the `iput` is probably there but just not printed.

Looking again at the reproducer, it calls `setxattr` on `./file0/file0`, creates the EA inode, and then `unlink` the original file. The question is how the kernel manages to truncate the EA inode after the original file is unlinked.

The core of the issue lies in *how* `evict` is being called. It's likely that after `unlink`, the system is releasing the dentry (and therefore the inode). If the EA inode's refcount drops to zero after the normal file gets unlinked, `ext4_xattr_delete_inode` decrements the EA inode and calls `iput` on the EA inode. The call to `iput` triggers the `evict` and therefore `ext4_evict_inode` for the EA inode, causing `ext4_truncate` to be called on the EA inode. Thus, `do_unlinkat` can't directly truncate the EA inode, because the correct path is: `do_unlinkat` -> `evict` (on normal file) -> `ext4_evict_inode` (on normal file) -> `ext4_xattr_delete_inode` (decrements EA refcount and calls iput if 0) -> `iput` (on EA inode) -> `evict` (on EA inode) -> `ext4_evict_inode` (on EA inode) -> `ext4_truncate`. The critical error here is most likely the lockdep tool has missed frames in the stack trace, or the stack unwinding has failed, and skipped a step.

Thus, the lockdep report is correctly pointing to a data race because `ext4_truncate` is being called with `&ei->i_data_sem/3` on an EA inode, but the path from `do_unlinkat` suggests a misunderstanding of how the inode is unlinked, and that the report is correct.

map[ContextFile:fs/ext4/inode.c IncludeLines:true Name:ext4_evict_inode]

map[SourceCode: 162:	/*
 163:	 * Called at the last iput() if i_nlink is zero.
 164:	 */
 165:	void ext4_evict_inode(struct inode *inode)
 166:	{
 167:		handle_t *handle;
 168:		int err;
 169:		/*
 170:		 * Credits for final inode cleanup and freeing:
 171:		 * sb + inode (ext4_orphan_del()), block bitmap, group descriptor
 172:		 * (xattr block freeing), bitmap, group descriptor (inode freeing)
 173:		 */
 174:		int extra_credits = 6;
 175:		struct ext4_xattr_inode_array *ea_inode_array = NULL;
 176:		bool freeze_protected = false;
 177:	
 178:		trace_ext4_evict_inode(inode);
 179:	
 180:		dax_break_layout_final(inode);
 181:	
 182:		if (EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL)
 183:			ext4_evict_ea_inode(inode);
 184:		if (inode->i_nlink) {
 185:			truncate_inode_pages_final(&inode->i_data);
 186:	
 187:			goto no_delete;
 188:		}
 189:	
 190:		if (is_bad_inode(inode))
 191:			goto no_delete;
 192:		dquot_initialize(inode);
 193:	
 194:		if (ext4_should_order_data(inode))
 195:			ext4_begin_ordered_truncate(inode, 0);
 196:		truncate_inode_pages_final(&inode->i_data);
 197:	
 198:		/*
 199:		 * For inodes with journalled data, transaction commit could have
 200:		 * dirtied the inode. And for inodes with dioread_nolock, unwritten
 201:		 * extents converting worker could merge extents and also have dirtied
 202:		 * the inode. Flush worker is ignoring it because of I_FREEING flag but
 203:		 * we still need to remove the inode from the writeback lists.
 204:		 */
 205:		if (!list_empty_careful(&inode->i_io_list))
 206:			inode_io_list_del(inode);
 207:	
 208:		/*
 209:		 * Protect us against freezing - iput() caller didn't have to have any
 210:		 * protection against it. When we are in a running transaction though,
 211:		 * we are already protected against freezing and we cannot grab further
 212:		 * protection due to lock ordering constraints.
 213:		 */
 214:		if (!ext4_journal_current_handle()) {
 215:			sb_start_intwrite(inode->i_sb);
 216:			freeze_protected = true;
 217:		}
 218:	
 219:		if (!IS_NOQUOTA(inode))
 220:			extra_credits += EXT4_MAXQUOTAS_DEL_BLOCKS(inode->i_sb);
 221:	
 222:		/*
 223:		 * Block bitmap, group descriptor, and inode are accounted in both
 224:		 * ext4_blocks_for_truncate() and extra_credits. So subtract 3.
 225:		 */
 226:		handle = ext4_journal_start(inode, EXT4_HT_TRUNCATE,
 227:				 ext4_blocks_for_truncate(inode) + extra_credits - 3);
 228:		if (IS_ERR(handle)) {
 229:			ext4_std_error(inode->i_sb, PTR_ERR(handle));
 230:			/*
 231:			 * If we're going to skip the normal cleanup, we still need to
 232:			 * make sure that the in-core orphan linked list is properly
 233:			 * cleaned up.
 234:			 */
 235:			ext4_orphan_del(NULL, inode);
 236:			if (freeze_protected)
 237:				sb_end_intwrite(inode->i_sb);
 238:			goto no_delete;
 239:		}
 240:	
 241:		if (IS_SYNC(inode))
 242:			ext4_handle_sync(handle);
 243:	
 244:		/*
 245:		 * Set inode->i_size to 0 before calling ext4_truncate(). We need
 246:		 * special handling of symlinks here because i_size is used to
 247:		 * determine whether ext4_inode_info->i_data contains symlink data or
 248:		 * block mappings. Setting i_size to 0 will remove its fast symlink
 249:		 * status. Erase i_data so that it becomes a valid empty block map.
 250:		 */
 251:		if (ext4_inode_is_fast_symlink(inode))
 252:			memset(EXT4_I(inode)->i_data, 0, sizeof(EXT4_I(inode)->i_data));
 253:		inode->i_size = 0;
 254:		err = ext4_mark_inode_dirty(handle, inode);
 255:		if (err) {
 256:			ext4_warning(inode->i_sb,
 257:				     "couldn't mark inode dirty (err %d)", err);
 258:			goto stop_handle;
 259:		}
 260:		if (inode->i_blocks) {
 261:			err = ext4_truncate(inode);
 262:			if (err) {
 263:				ext4_error_err(inode->i_sb, -err,
 264:					       "couldn't truncate inode %lu (err %d)",
 265:					       inode->i_ino, err);
 266:				goto stop_handle;
 267:			}
 268:		}
 269:	
 270:		/* Remove xattr references. */
 271:		err = ext4_xattr_delete_inode(handle, inode, &ea_inode_array,
 272:					      extra_credits);
 273:		if (err) {
 274:			ext4_warning(inode->i_sb, "xattr delete (err %d)", err);
 275:	stop_handle:
 276:			ext4_journal_stop(handle);
 277:			ext4_orphan_del(NULL, inode);
 278:			if (freeze_protected)
 279:				sb_end_intwrite(inode->i_sb);
 280:			ext4_xattr_inode_array_free(ea_inode_array);
 281:			goto no_delete;
 282:		}
 283:	
 284:		/*
 285:		 * Kill off the orphan record which ext4_truncate created.
 286:		 * AKPM: I think this can be inside the above `if'.
 287:		 * Note that ext4_orphan_del() has to be able to cope with the
 288:		 * deletion of a non-existent orphan - this is because we don't
 289:		 * know if ext4_truncate() actually created an orphan record.
 290:		 * (Well, we could do this if we need to, but heck - it works)
 291:		 */
 292:		ext4_orphan_del(handle, inode);
 293:		EXT4_I(inode)->i_dtime	= (__u32)ktime_get_real_seconds();
 294:	
 295:		/*
 296:		 * One subtle ordering requirement: if anything has gone wrong
 297:		 * (transaction abort, IO errors, whatever), then we can still
 298:		 * do these next steps (the fs will already have been marked as
 299:		 * having errors), but we can't free the inode if the mark_dirty
 300:		 * fails.
 301:		 */
 302:		if (ext4_mark_inode_dirty(handle, inode))
 303:			/* If that failed, just do the required in-core inode clear. */
 304:			ext4_clear_inode(inode);
 305:		else
 306:			ext4_free_inode(handle, inode);
 307:		ext4_journal_stop(handle);
 308:		if (freeze_protected)
 309:			sb_end_intwrite(inode->i_sb);
 310:		ext4_xattr_inode_array_free(ea_inode_array);
 311:		return;
 312:	no_delete:
 313:		/*
 314:		 * Check out some where else accidentally dirty the evicting inode,
 315:		 * which may probably cause inode use-after-free issues later.
 316:		 */
 317:		WARN_ON_ONCE(!list_empty_careful(&inode->i_io_list));
 318:	
 319:		if (!list_empty(&EXT4_I(inode)->i_fc_list))
 320:			ext4_fc_mark_ineligible(inode->i_sb, EXT4_FC_REASON_NOMEM, NULL);
 321:		ext4_clear_inode(inode);	/* We must guarantee clearing of inode... */
 322:	}
 SourceFile:fs/ext4/inode.c]

gemini-3.1-pro-preview

							input: 151567
							output: 43
							thoughts: 1819
						

**My Analysis of the Ext4 Lockdep Report**

Okay, let's break this down. Line 261 of `fs/ext4/inode.c` shows `ext4_evict_inode` calling `ext4_truncate`, and the stack trace confirms that. So, `ext4_truncate` is definitely being called from within `ext4_evict_inode`, which itself is called by `evict`, which in turn, is triggered by `do_unlinkat`. This means we're unlinking something, and that unlink operation is leading to a call to `ext4_truncate`.

The lockdep report is the kicker though. It says `ext4_truncate` is holding `&ei->i_data_sem/3`. This indicates that the inode that's being truncated has `i_data_sem` of subclass 3.  But wait a minute... I know that subclass 3 is ONLY set by `ext4_xattr_inode_set_class`. That function is only used on Extended Attribute (EA) inodes. The problem is, `do_unlinkat` *shouldn't* be able to unlink an EA inode because `ext4_lookup` rejects them!

So, could there be a backdoor?  Could a regular file somehow end up with the EA inode's subclass? Let's check: in `ext4_xattr_inode_iget`, if `ext4_iget` returns a regular file, it's rejected by `check_igot_inode` UNLESS it's already in the cache. If it *is* in the cache, `check_igot_inode` is called. The check looks for `EXT4_EA_INODE_FL`, and if the normal file does NOT have this flag, `check_igot_inode` would return `-EFSCORRUPTED`, making it impossible for `ext4_xattr_inode_set_class` to be called. If it *does* have the flag, it's rejected by `ext4_lookup` anyway.

So the classic path is blocked. Is there some subtle timing issue? Could the file be created by `open(O_CREAT)`? No, it wouldn't have the flag. What about `setxattr`?  That *would* set the flag, but the file wouldn't yet be in the directory.

Okay, let's think about a normal file being unlinked. `ext4_truncate` takes `&ei->i_data_sem` (subclass 0), and then calls `ext4_try_to_expand_extra_isize`, which creates an EA inode. Now the EA inode would get its `inode_lock` (subclass 1), but the dependency would be `&ei->i_data_sem/0` -> `&sb->s_type->i_mutex_key#9/1`. But the lockdep report shows `&ei->i_data_sem/3` -> `&sb->s_type->i_mutex_key#9/1`. Something isn't right here.

Lockdep tracks *lock classes*, which are a combination of the lock key and the subclass.  Therefore, `&ei->i_data_sem/0` and `&ei->i_data_sem/3` are different classes! Lockdep is reporting class 3... That means we're *holding* `&ei->i_data_sem` with subclass 3. How could `ext4_truncate` do that? The only way is if the inode *already* has subclass 3. That means the inode *must* be an EA inode. But how can it be unlinked?

Wait, what if `do_unlinkat` is unlinking a directory? No. How about if the EA inode was looked up by `ext4_lookup` *before* `EXT4_EA_INODE_FL` was set? No, it's only set when the EA inode is created. And renames and links use `ext4_lookup`, so those are dead ends too.

What about `open_by_handle_at`? That uses `ext4_iget` with the handle, but `check_igot_inode` would reject it. Even the root inode is checked!

Could the EA inode be added to the dcache? No.

Could this be a false positive due to lock class aliasing?  No, because the subclass *matters*. `i_data_sem` is initialized in `ext4_alloc_inode`, not `inode_init_always_gfp`.

... So, unless there's some kind of obscure race or a subtle bug in how we're tracking the lock class, I'

map[ContextFile:fs/ext4/super.c IncludeLines:true Name:ext4_alloc_inode]

map[SourceCode:1377:	/*
1378:	 * Called inside transaction, so use GFP_NOFS
1379:	 */
1380:	static struct inode *ext4_alloc_inode(struct super_block *sb)
1381:	{
1382:		struct ext4_inode_info *ei;
1383:	
1384:		ei = alloc_inode_sb(sb, ext4_inode_cachep, GFP_NOFS);
1385:		if (!ei)
1386:			return NULL;
1387:	
1388:		inode_set_iversion(&ei->vfs_inode, 1);
1389:		ei->i_flags = 0;
1390:		spin_lock_init(&ei->i_raw_lock);
1391:		ei->i_prealloc_node = RB_ROOT;
1392:		atomic_set(&ei->i_prealloc_active, 0);
1393:		rwlock_init(&ei->i_prealloc_lock);
1394:		ext4_es_init_tree(&ei->i_es_tree);
1395:		rwlock_init(&ei->i_es_lock);
1396:		INIT_LIST_HEAD(&ei->i_es_list);
1397:		ei->i_es_all_nr = 0;
1398:		ei->i_es_shk_nr = 0;
1399:		ei->i_es_shrink_lblk = 0;
1400:		ei->i_reserved_data_blocks = 0;
1401:		spin_lock_init(&(ei->i_block_reservation_lock));
1402:		ext4_init_pending_tree(&ei->i_pending_tree);
1403:	#ifdef CONFIG_QUOTA
1404:		ei->i_reserved_quota = 0;
1405:		memset(&ei->i_dquot, 0, sizeof(ei->i_dquot));
1406:	#endif
1407:		ei->jinode = NULL;
1408:		INIT_LIST_HEAD(&ei->i_rsv_conversion_list);
1409:		spin_lock_init(&ei->i_completed_io_lock);
1410:		ei->i_sync_tid = 0;
1411:		ei->i_datasync_tid = 0;
1412:		INIT_WORK(&ei->i_rsv_conversion_work, ext4_end_io_rsv_work);
1413:		ext4_fc_init_inode(&ei->vfs_inode);
1414:		spin_lock_init(&ei->i_fc_lock);
1415:		return &ei->vfs_inode;
1416:	}
 SourceFile:fs/ext4/super.c]

gemini-3.1-pro-preview

							input: 155221
							output: 24
							thoughts: 28
						

Okay, here's my take on those thoughts, framed as an expert's internal monologue:

**Investigating a Potential Ext4 Inode Allocation Issue**

Right, let's see. Hang on a minute... I'm looking at `ext4_alloc_inode` and something's immediately jumping out at me. The code's checking `i_data_sem` in `ext4_alloc_inode` but... *wait a second*, I don't see any explicit initialization of `i_data_sem` *before* that point. This doesn't sit right with me. I'm used to seeing that semaphore properly set up before it's used. This is a potential threading issue waiting to happen! Now, where, in the code, is this semaphore actually initialized? I need to track down where this crucial initialization happens. I have to figure out if there's a race condition lurking here, or perhaps a subtle bug in how inodes are being managed. I should start digging through the related structures to see where this value is first set. This could be a sneaky concurrency flaw!

map[Expression:init_rwsem.*i_data_sem]

map[Output:fs/ext4/mballoc-test.c=33=static struct inode *mbt_alloc_inode(struct super_block *sb)
--
fs/ext4/mballoc-test.c-42-	init_rwsem(&ei->xattr_sem);
fs/ext4/mballoc-test.c:43:	init_rwsem(&ei->i_data_sem);
fs/ext4/mballoc-test.c-44-	inode_init_once(&ei->vfs_inode);
--
fs/ext4/super.c=1464=static void init_once(void *foo)
--
fs/ext4/super.c-1469-	init_rwsem(&ei->xattr_sem);
fs/ext4/super.c:1470:	init_rwsem(&ei->i_data_sem);
fs/ext4/super.c-1471-	inode_init_once(&ei->vfs_inode);
--
fs/udf/super.c=150=static struct inode *udf_alloc_inode(struct super_block *sb)
--
fs/udf/super.c-164-	ei->i_hidden = 0;
fs/udf/super.c:165:	init_rwsem(&ei->i_data_sem);
fs/udf/super.c-166-	ei->cached_extent.lstart = -1;
]

gemini-3.1-pro-preview

							input: 155877
							output: 41
							thoughts: 1243
						

**Lockdep False Positive Investigation**

Okay, let's break this down. My initial thought is, `i_data_sem` is initialized within `init_once`, which is the slab constructor for `ext4_inode_cachep`. That means all ext4 inodes share the *same* lock class for `i_data_sem`. Now, `lockdep_set_subclass` changes the subclass, but only for a specific inode. So, if `lockdep_set_subclass` is called, it's modifying that *individual* inode's `dep_map`.

Wait a minute, what happens if a slab object is used for an EA inode, gets freed, and then gets reallocated for a normal file? Does `i_data_sem` get re-initialized? Nope! `ext4_alloc_inode` doesn't call `init_rwsem(&ei->i_data_sem)`. That initialization happens in `init_once`. On the other hand, `inode_init_always` calls `init_rwsem(&inode->i_rwsem)`, so `i_rwsem` *is* re-initialized. That means `i_data_sem` retains its `dep_map` from its previous use.

BINGO! This is the classic slab object reuse issue that leads to lockdep false positives, because the lockdep map isn't reinitialized when reusing the slab object. This means if the slab was used for an EA inode (subclass 3), then gets reallocated to a normal file, that normal file's `i_data_sem` *still* has subclass 3.

Let's confirm this theory. When `ext4_truncate` is called on the normal file it will acquire `&ei->i_data_sem/3`. Then it creates an EA inode, takes `inode_lock` (subclass 1), and this will create the dependency `&ei->i_data_sem/3` -> `&sb->s_type->i_mutex_key#9/1`. Now I remember that `setxattr` was called on the normal file. It takes `inode_lock` with subclass 0. Then it creates an EA inode.

So the dependency is `inode_lock` (subclass 0) -> `&ei->i_data_sem/3`. However, the lockdep report says: `&sb->s_type->i_mutex_key#9/1` -> `&ei->i_data_sem/3`. How does that happen? Ah! `inode_lock` of the EA inode is subclass 1, I need to understand how the locking works on the directory versus the file. Ah, I see! `vfs_setxattr` takes `inode_lock(inode)` and it's subclass 0 by default, even for directories! `I_MUTEX_PARENT` is only used in certain situations. I need to verify what the reproducer is doing. Okay, looks like it's a file inside a directory. So, the `setxattr` is being called on a file, so it takes subclass 0. The report is consistent with my current thinking. This confirms my theory!

map[ContextFile:fs/xattr.c IncludeLines:true Name:vfs_setxattr]

map[SourceCode: 303:	int
 304:	vfs_setxattr(struct mnt_idmap *idmap, struct dentry *dentry,
 305:		     const char *name, const void *value, size_t size, int flags)
 306:	{
 307:		struct inode *inode = dentry->d_inode;
 308:		struct inode *delegated_inode = NULL;
 309:		const void  *orig_value = value;
 310:		int error;
 311:	
 312:		if (size && strcmp(name, XATTR_NAME_CAPS) == 0) {
 313:			error = cap_convert_nscap(idmap, dentry, &value, size);
 314:			if (error < 0)
 315:				return error;
 316:			size = error;
 317:		}
 318:	
 319:	retry_deleg:
 320:		inode_lock(inode);
 321:		error = __vfs_setxattr_locked(idmap, dentry, name, value, size,
 322:					      flags, &delegated_inode);
 323:		inode_unlock(inode);
 324:	
 325:		if (delegated_inode) {
 326:			error = break_deleg_wait(&delegated_inode);
 327:			if (!error)
 328:				goto retry_deleg;
 329:		}
 330:		if (value != orig_value)
 331:			kfree(value);
 332:	
 333:		return error;
 334:	}
 SourceFile:fs/xattr.c]

gemini-3.1-pro-preview

							input: 158341
							output: 26
							thoughts: 3298
						

**Lockdep Analysis: A Deep Dive into Ext4 Xattr Locking**

Okay, so `inode_lock(inode)` is definitely in play, and it defaults to subclass 0.  But, why is lockdep flagging `&sb->s_type->i_mutex_key#9/1`?  I remember that `i_rwsem` resets its subclass every time it's re-initialized during inode allocation, using `inode_init_always_gfp`.  So, `i_rwsem` doesn't retain its subclass across allocations.  But, crucially, `i_data_sem` DOES.

I'm following the logic: `ext4_truncate` on a normal file would take `&ei->i_data_sem/3`. Then, we create an EA inode, and that new EA inode gets a fresh `i_rwsem` (subclass 0), and then we call `ext4_xattr_inode_set_class` which sets the EA inode's `i_rwsem` to subclass 1, and its `i_data_sem` to subclass 3. Then, `ext4_xattr_inode_create` then takes `inode_lock(ea_inode)` (subclass 1). The reported dependency is `&ei->i_data_sem/3` -> `&sb->s_type->i_mutex_key#9/1`.

But how about the reverse dependency, `&sb->s_type->i_mutex_key#9/1` -> `&ei->i_data_sem/3`?  Lockdep points us to `__vfs_setxattr` as the culprit. But `vfs_setxattr` calls `inode_lock` (subclass 0) - so how can it report a dependency on a *different* subclass of the same key?  This leads me to believe the lock must have been held with subclass 1 *prior* to `vfs_setxattr`.

I tried to follow the control path in `do_setxattr` but this wouldn't work.  So, I carefully re-examined the lockdep report.  The report indicates `&sb->s_type->i_mutex_key#9/1` is for `inode_lock(ea_inode)` within `ext4_xattr_inode_create`. Now, `vfs_setxattr` calls `inode_lock` (subclass 0) which is `&sb->s_type->i_mutex_key#9`.  So, a direct dependency should be `&sb->s_type->i_mutex_key#9` -> `&ei->i_data_sem/3`.  But lockdep reports a circular dependency!  If `&sb->s_type->i_mutex_key#9` and `&sb->s_type->i_mutex_key#9/1` are distinct lock classes, then it *shouldn't* be a cycle.

I'm thinking lockdep is doing the right thing and is differentiating between different subclasses. The actual existing dependency chain reported is `&sb->s_type->i_mutex_key#9/1` -> `&ei->i_data_sem/3`. This means that at *some* point in the execution, `&sb->s_type->i_mutex_key#9/1` was acquired, then `&ei->i_data_sem/3` was acquired, *during* the execution.

It must be within `ext4_xattr_inode_create`, where `inode_lock(ea_inode)` (subclass 1) is taken *before* calling `ext4_xattr_inode_write`. Wait a minute - that lock is released! Then how can there be a dependency `&sb->s_type->i_mutex_key#9/1` -> `&ei->i_data_sem/3`?  Ah! What if it's called on a directory with `inode_lock` with subclass 1? But no, `inode_lock` on the directory uses subclass 0 as well.

Let me revisit the stack trace for where `#1` (`&ei->i_data_sem/3`) was acquired. This stack trace is only for when `&ei->i_data_sem/3` was acquired; It *doesn't* show where the *other* lock was acquired. Because lockdep indicates a dependency `#1` depends on `#0`. The `ext4_xattr_inode_write` routine must be running in a context where `&sb->s_type->i_mutex_key#9/1` is

map[Expression:lockdep_set_subclass.*i_rwsem]

map[Output:fs/ext4/xattr.c=122=void ext4_xattr_inode_set_class(struct inode *ea_inode)
--
fs/ext4/xattr.c-125-
fs/ext4/xattr.c:126:	lockdep_set_subclass(&ea_inode->i_rwsem, 1);
fs/ext4/xattr.c-127-	(void) ei;	/* shut up clang warning if !CONFIG_LOCKDEP */
]

gemini-3.1-pro-preview

							input: 162824
							output: 43
							thoughts: 3447
						

**Lockdep and Ext4 Extended Attributes: A Deep Dive**

Okay, so here's what's running through my head.  It all started with an observation: this issue seems to be exclusively within `ext4_xattr_inode_set_class`. That screams "EA inode" to me. But how can `vfs_setxattr` even be called on an EA inode? I considered the file descriptor route, a file opened before it became an EA inode, or access via `open_by_handle_at`, and the `/proc/self/fd/` hack. All these were rejected because the `check_igot_inode` function prevented these scenarios. Could this be triggered by a crafted image? Nope, `check_igot_inode` again. What if the EA inode shows up by calling `ext4_lookup`, or `ext4_new_inode`?  Still, the `check_igot_inode` function guards these routes. So, is there ANY path that doesn't use `check_igot_inode`?

Then I moved to the lockdep report. It looked like a cycle, and I figured I better understand the lock class dependencies. Initially I thought it was an issue with subclasses, but it turns out that lockdep treats subclasses as different lock classes. Here's where it got interesting. The report shows a task trying to acquire `&sb->s_type->i_mutex_key#9/1` but *already* holding `&ei->i_data_sem/3`. This meant `&ei->i_data_sem/3` was a dependency of `&sb->s_type->i_mutex_key#9/1`. But the report said this dependency already existed in reverse!

The "existing dependency chain" details provided the clue.  The existing chain showed a lock `#1` (sem) depending on a lock `#0` (mutex). The stack trace showed that `ext4_truncate` had acquired lock `#0` before the other operation.  So `#0` was the base lock class `&sb->s_type->i_mutex_key#9/1`, and `#1` was `&ei->i_data_sem/3`. Also, this lock class could have been acquired in `ext4_xattr_inode_create`.

So, the report indicates a chain: `&sb->s_type->i_mutex_key#9/1`  -> `&ei->i_data_sem/3`. The stack trace of the existing chain is critical. It said that the existing dependency was  `vfs_setxattr` holding `&sb->s_type->i_mutex_key#9/1`, so then the `vfs_setxattr` was calling `ext4_xattr_inode_write`. But how does `vfs_setxattr` end up with the right subclass?  Is it the case that `vfs_setxattr` somehow held subclass 1? This makes no sense, since `vfs_setxattr` calls `inode_lock`, which uses subclass 0!

I then re-examined the stack traces. The stack trace for `#0` includes  `ext4_truncate`, which does not call `vfs_setxattr`. This means the provided stack traces show *one* place where the lock class is acquired, not what is held during the call.  This means `#0` (`&sb->s_type->i_mutex_key#9/1`) was acquired during `ext4_truncate`, and `#1` (`&ei->i_data_sem/3`) was acquired in `ext4_xattr_inode_write` (which is part of `vfs_setxattr`).

If we have a dependency `#0` -> `#1`, does this mean `#0` was held while `#1` was acquired? No, in `ext4_xattr_inode_create`, the lock is actually released before returning.

The core question: What is causing the incorrect dependency? I think the culprit is slab reuse! If the normal file had subclass 1 from being reused, from an EA inode that held the same lock class, then this explains the report. The code sets the lock to subclass 0, so I need to go verify that this lock reset logic is working.

requested entity does not exist

map[ContextFile:include/linux/lockdep.h IncludeLines:true Name:lockdep_set_class]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 167267
							output: 21
							thoughts: 13
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Analyzing Lockdep Class Assignment**

Okay, so I'm diving into this. The task at hand is to understand how lock classes are being assigned, and the immediate thought is to zero in on the core function responsible for setting them. That means `lockdep_set_class` is the logical place to start. This function is the pivotal point for, well, setting the lock dependency class. I need to understand where and how `lockdep_set_class` is being called, which will illuminate the different contexts where lock classes are being established. This includes not just the immediate calls to the function itself, but also any pre-processing or wrapper functions which might ultimately feed into it. Grepping for it will give me a comprehensive list of all the direct and potential call sites. Time to see what the code reveals.

map[Expression:define lockdep_set_class]

map[Output:include/linux/lockdep.h=145=static inline void lockdep_init_map(struct lockdep_map *lock, const char *name,
--
include/linux/lockdep.h-156- */
include/linux/lockdep.h:157:#define lockdep_set_class(lock, key)				\
include/linux/lockdep.h-158-	lockdep_init_map_type(&(lock)->dep_map, #key, key, 0,	\
--
include/linux/lockdep.h-162-
include/linux/lockdep.h:163:#define lockdep_set_class_and_name(lock, key, name)		\
include/linux/lockdep.h-164-	lockdep_init_map_type(&(lock)->dep_map, name, key, 0,	\
--
include/linux/lockdep.h-168-
include/linux/lockdep.h:169:#define lockdep_set_class_and_subclass(lock, key, sub)		\
include/linux/lockdep.h-170-	lockdep_init_map_type(&(lock)->dep_map, #key, key, sub,	\
--
include/linux/lockdep.h=332=static inline void lockdep_set_selftest_task(struct task_struct *task)
--
include/linux/lockdep.h-350-		do { (void)(name); (void)(key); } while (0)
include/linux/lockdep.h:351:# define lockdep_set_class(lock, key)		do { (void)(key); } while (0)
include/linux/lockdep.h:352:# define lockdep_set_class_and_name(lock, key, name) \
include/linux/lockdep.h-353-		do { (void)(key); (void)(name); } while (0)
include/linux/lockdep.h:354:#define lockdep_set_class_and_subclass(lock, key, sub) \
include/linux/lockdep.h-355-		do { (void)(key); } while (0)
]

gemini-3.1-pro-preview

							input: 168037
							output: 66
							thoughts: 4215
						

**Analysis of a Lockdep False Positive in ext4**

Okay, so I'm diving into this lockdep report. It initially seemed like a straightforward issue with `vfs_setxattr` and how it interacts with inode locks, specifically around subclassing. But something felt off. `lockdep_set_class` should be correctly initializing the relevant semaphores. The code seemed to imply that there was some conflict with the inode lock and the extended attribute (EA) inode lock, but my initial assumptions were wrong.

My first thought process was trying to figure out why a new EA inode's lock would have an incorrect subclass. I was considering the interaction of `vfs_setxattr` and the directory's lock. Maybe `vfs_setxattr` was being called from a context where the directory lock already held a different subclass? Nope. `inode_lock` defaults to subclass 0, so that wasn't the issue. 

Then I looked at the actual lockdep report.  It showed a dependency between `&ei->i_data_sem/3` and `&sb->s_type->i_mutex_key#9/1`.  That's a bit strange. The report was telling me that one lock already depends on the other. Okay, so I went through the stack traces. The dependency seems to arise during `ext4_truncate` when it acquires `&ei->i_data_sem/3` and during `ext4_xattr_inode_create`, which takes `inode_lock`.  The dependency seemed to be between the truncate path and the EA inode creation path.

My thoughts were directed at figuring out what was going on.  I thought that the EA inode write path was holding the inode lock (via `inode_lock(ea_inode)`) when `ext4_xattr_inode_write` was called, and that was obviously incorrect. But the code does not retain the lock. So how does this dependency occur?

Then I considered the possibility of a lockdep false positive. That's a good place to start, considering it's a WARNING. I walked through a simplified scenario: Thread A holding Lock A, acquiring Lock B, then Thread B holding Lock B and acquiring Lock A. And this would result in a cycle.

I zeroed in on the idea of the EA inode path and considered that maybe `vfs_setxattr` could be called on an EA inode. But that's not possible due to how the ext4 lookup works. Then I focused on a possible flaw with how the EA inode was created.

Then the idea of `inode_lock_nested` on a directory came to mind.  That locks the directory with subclass 1!  And `vfs_setxattr` doesn't acquire the directory lock. So I started thinking about the scenario of a directory being locked with `I_MUTEX_PARENT` and then `vfs_setxattr` being called on a file *within* that directory.  This *could* create the dependency!

Yes, that makes sense. The lock class for a directory locked with `I_MUTEX_PARENT` is indeed `&sb->s_type->i_mutex_key#9/1`. Then it became clear: If the directory is locked with `I_MUTEX_PARENT` (subclass 1), a file *within* that directory has its `i_data_sem` acquired (subclass 3), there is a dependency. This seemed plausible.

Let me prove this out.  I need to find a path where `I_MUTEX_PARENT` is held, then a call acquiring `i_data_sem`. `do_unlinkat` comes to mind.  It holds `I_MUTEX_PARENT` on the directory and then calls `iput`, potentially leading to `ext4_truncate`.  `ext4_truncate` takes `i_data_sem` of the unlinked file, which seemed to be the key!

So how does `i_data_sem` get subclass 3? I remember the SLAB reuse! The normal file can retain subclass 3 because `i_data_sem` isn't re-initialized. Aha! The normal file can have subclass 3 from a previously freed EA inode! Now `ext4_truncate` in the eviction path takes the wrong lock. And `ext4_truncate` then calls `ext4_xattr_inode_create` which acquires the EA inode's lock (subclass 1). Bingo! The cycle is there!  Lock B (`I_MUTEX_PARENT` on the directory) depends on Lock A (`i_data_sem/3` of the file) and Lock A depends on Lock B.

But is there an actual deadlock? I need to analyze

map[DenialOfService:false Exploitable:false FilesystemTrigger:true NetworkTrigger:false PeripheralTrigger:false RemoteTrigger:false Unprivileged:true UserNamespace:false VMGuestTrigger:false VMHostTrigger:false]

map[DenialOfService:false Exploitable:false FilesystemTrigger:true NetworkTrigger:false PeripheralTrigger:false RemoteTrigger:false Unprivileged:true UserNamespace:false VMGuestTrigger:false VMHostTrigger:false]

gemini-3.1-pro-preview

							input: 173407
							output: 607
							thoughts: 508
						

**My Analysis of the Lockdep False Positive**

Okay, the analysis is done, and it's time to craft the final response. My understanding is this: we've got a lockdep false positive stemming from slab object reuse, specifically within the `ext4` file system.

Here's the gist: the `ext4_inode_cachep` uses a constructor, `init_once`, to initialize `i_data_sem`. Now, when an Extended Attribute (EA) inode gets created, `ext4_xattr_inode_set_class` steps in and modifies the lockdep subclass of `i_data_sem` to 3, which is `I_DATA_SEM_EA`. When that EA inode is eventually freed, the corresponding slab object gets returned to the cache. The crux of the issue is that when that same slab object is later recycled for a *normal* file, `i_data_sem` *isn't* re-initialized. This means it retains its subclass 3.

Fast forward to a `do_unlinkat` call unlinking this normal file. It's holding the directory's `inode_lock`, which has subclass 1 (`I_MUTEX_PARENT`). During the unlink process, `iput` is called, which then triggers `ext4_evict_inode` and subsequently `ext4_truncate`. And, boom, `ext4_truncate` acquires `i_data_sem` of the normal file. Problem! It's still sporting subclass 3, thus creating a lockdep dependency: subclass 1 -> subclass 3.

Now, things get a bit more convoluted. Later on, `ext4_truncate` might call `ext4_try_to_expand_extra_isize`, which involves creating a new EA inode. When this EA inode gets created, `ext4_xattr_inode_set_class` comes in and assigns its `inode_lock` subclass 1. This creates the reverse lockdep dependency: subclass 3 -> subclass 1. Lockdep, of course, flags this as a circular dependency, hence the WARNING.

However, and this is critical, it's a false positive. Here's why:

1.  The subclass 3 on that normal file is simply a leftover from the slab reuse. It's not representative of the actual locking situation.
2.  The subclass 1 locks are on *different* inodes—the directory and the newly minted EA inode. They're distinct and can't actually alias in a way that would lead to a real deadlock.

Thankfully, lockdep is disabled in production kernels. So this WARNING won't be triggered in the field. This also means the underlying locking pattern, even though it looks suspect, cannot cause an actual deadlock. There is no security impact from this: no denial of service, no privilege escalation. It’s important to note, however, that the bug *can* be triggered by an unprivileged user on a standard ext4 filesystem. All that's required is a bit of manipulation of the slab cache by creating and deleting EA inodes (through large xattrs) and then unlinking files.

map[Explanation:Based on the analysis of the bug report and the ext4 source code, here is the
assessment of the security impact:

**Analysis:**
The bug is a **lockdep false positive** caused by slab object reuse without
re-initializing the lockdep class.

1. Ext4 inodes are allocated from `ext4_inode_cachep`, which uses a slab
constructor (`init_once`) to initialize the `i_data_sem` rw_semaphore.
2. When an inode is used to store large extended attributes (an EA inode),
`ext4_xattr_inode_set_class()` is called, which changes the lockdep subclass of
`i_data_sem` to `3` (`I_DATA_SEM_EA`).
3. When the EA inode is deleted and its slab object is freed, the lockdep
subclass remains `3`. If this slab object is subsequently reallocated for a
*normal* file, its `i_data_sem` incorrectly retains subclass `3` because
`ext4_alloc_inode()` does not re-initialize the semaphore.
4. When an unprivileged user unlinks this normal file, `do_unlinkat()` acquires
the parent directory's `inode_lock` (which uses subclass `1`, `I_MUTEX_PARENT`).
It then drops the last reference to the file, triggering `ext4_evict_inode()` ->
`ext4_truncate()`.
5. `ext4_truncate()` acquires the file's `i_data_sem` (which is still subclass
`3`). This establishes a lockdep dependency: **subclass 1 -> subclass 3**.
6. During truncation, `ext4_try_to_expand_extra_isize()` may be called, which
creates a *new* EA inode. Creating the EA inode acquires its `inode_lock`, which
is explicitly assigned subclass `1` by `ext4_xattr_inode_set_class()`. This
establishes the reverse dependency: **subclass 3 -> subclass 1**.

Lockdep detects this cycle and emits a WARNING. However, a real deadlock is
**impossible** because the two subclass `1` locks belong to completely different
inodes (an existing parent directory vs. a newly created, unlinked EA inode).

Since lockdep is a debugging tool that is disabled in production kernel builds,
this WARNING will not occur in production environments. Furthermore, because a
real deadlock cannot happen, there is no risk of a system hang or crash.

**Conclusion:**
The bug has **no security impact**. It cannot be exploited for memory corruption
or privilege escalation, and it does not cause a Denial of Service in production
builds. It can be triggered by an unprivileged user on a standard ext4
filesystem simply by setting large xattrs (to create EA inodes), deleting them,
and then creating/unlinking normal files to manipulate the slab cache.]