| 0/0 |
2026/05/24 07:36 |
flow |
assessment-security |
48m
Results: map[DenialOfService:false Explanation:Based on the analysis of the crash report and the kernel source code, here is
the assessment of the bug:
### Root Cause Analysis
The crash is a `list_del` corruption occurring in `rwsem_try_write_lock` while a
task is executing `chown_common`. The corrupted list is
`inode->i_rwsem.wait_list`.
The sequence of events leading to the crash is as follows:
1. In `gfs2_create_inode`, the newly created inode is exposed to the VFS
prematurely by calling `d_instantiate(dentry, inode)` **before** calling
`unlock_new_inode(inode)`.
2. Because the dentry is now visible in the dcache, another concurrent task
(e.g., an unprivileged user running `chown` on the newly created directory) can
look it up and call `inode_lock_killable(inode)`.
3. The concurrent task acquires or waits on the `inode->i_rwsem`, adding its
`waiter` struct to the `wait_list`.
4. Meanwhile, the original task in `gfs2_create_inode` continues and finally
calls `unlock_new_inode(inode)`.
5. `unlock_new_inode` calls `lockdep_annotate_inode_mutex_key(inode)`. For
directories, this function assumes no one is holding the lock yet and explicitly
reinitializes it by calling `init_rwsem(&inode->i_rwsem)`.
6. This reinitialization clears the `wait_list` (setting `prev` and `next` to
point to the list head itself).
7. When the concurrent task wakes up and tries to remove its `waiter` from the
list via `list_del()`, it detects that the list head does not point back to the
`waiter`, triggering the `list_del corruption` BUG.
### Security Impact in Production Builds
While this causes a kernel BUG and a Denial of Service in the syzkaller
environment, **it has zero security impact in production builds**.
The function responsible for reinitializing the lock,
`lockdep_annotate_inode_mutex_key()`, is strictly a debugging feature. It is
conditionally compiled and only does anything if `CONFIG_LOCKDEP` is enabled:
```c
#ifdef CONFIG_LOCKDEP
void lockdep_annotate_inode_mutex_key(struct inode *inode)
{
...
init_rwsem(&inode->i_rwsem);
...
}
#else
static inline void lockdep_annotate_inode_mutex_key(struct inode *inode) { }
#endif
```
In a standard production kernel without debugging tools enabled (i.e.,
`CONFIG_LOCKDEP` is disabled), `lockdep_annotate_inode_mutex_key` is an empty
inline function. Consequently, `init_rwsem` is **never** called on the
already-exposed inode, and the `wait_list` is never corrupted.
The concurrent task will simply acquire the `i_rwsem` and then safely block on
the GFS2 internal glock (`ip->i_gl`), which is still correctly held by
`gfs2_create_inode` until it finishes its setup. There is no memory corruption,
no use-after-free, and no crash.
### Conclusion
This is a lockdep-induced false positive caused by a minor ordering issue in
GFS2 (`d_instantiate` before `unlock_new_inode`). It is not exploitable and
cannot cause a Denial of Service in production environments. Exploitable:false FilesystemTrigger:false NetworkTrigger:false PeripheralTrigger:false RemoteTrigger:false Unprivileged:false UserNamespace:false VMGuestTrigger:false VMHostTrigger:false]
|
| 1/1 |
2026/05/24 07:36 |
action |
syz-repro-to-c-repro |
0m
Results:
|
| 2/1 |
2026/05/24 07:36 |
action |
kernel-checkouter |
1m
Results: map[KernelSrc:/app/workdir/cache/src/467e55f613aaf753738bad9aa4d4d66a1b3a23eb]
|
| 3/1 |
2026/05/24 07:37 |
action |
kernel-builder |
24m
Results: map[KernelObj:/app/workdir/cache/build/c86ccc52c6ccd7831f9922359793d4502a48d534]
|
| 4/1 |
2026/05/24 08:02 |
action |
codesearch-prepare |
15m
Results: map[Index:codesearch-index]
|
| 5/1 |
2026/05/24 08:17 |
agent |
expert |
7m
Model:
Results: map[DenialOfService:false Exploitable:false FilesystemTrigger:false NetworkTrigger:false PeripheralTrigger:false RemoteTrigger:false Unprivileged:false UserNamespace:false VMGuestTrigger:false VMHostTrigger:false]
Instruction:
You are an experienced Linux kernel security engineer. Your task is to analyze given kernel bug report
and determine its security impact based on the following dimensions.
Use the provided tools to examine the source code, check for capability checks (e.g., capable(), ns_capable()),
and understand the nature of the bug. Analyze the given kernel build and configuration.
You can check the kernel config by grepping ".config" file; you can check kernel cmdline by greeping
".config" file for "CONFIG_CMDLINE=". Assume sysctl parameters have default values.
But analyze for the corresponding production build w/o debugging tools enabled (like KASAN, KMSAN, UBSAN).
Try different strategies when analyzing the bug:
- think of ways in which the vulnerable code is unreachable
- or the other way around: try to come up with different ideas of how an unprivileged user can reach the bug
If still unsure err on the side of the bug being non-exploitable/not-accessible.
In the final reply, provide a reasoning for your assessment.
Analysis dimensions:
* Exploitable:
Determine if the bug can result in memory corruption or elevated privileges.
Memory safety issues are almost always exploitable (KASAN or UBSAN reports for use-after-free, out-of-bounds;
refcounting issues, corrupted lists, etc). When kernel is crashing on a completly wild pointer access
(e.g. user-space address, or non-canonical address, but not on NULL or address corresponding to KASAN shadow
for NULL address), including both data accesses and control tranfers, that's also usually implies possibility
of exploitation. Such reports usually say "unable to handle kernel paging request".
Uses of uninitialized values detected by KMSAN may be exploitable b/c attacker frequently can affect uninit
values with spraying techniques. However, for these exploitabability depends on how exactly the uninit value
is used in the code, and what it affects.
Think of what happens after the bug is triggered. Some bugs cause kernel panic and halt execution,
they are harder to exploit. For example, BUG reports halts the kernel. However, WARNING reports don't halt
execution in production builds. Debug bug detection tools (like KASAN, KMSAN, KCSAN, UBSAN) are also not enabled
in production builds, so attacker can freely exploit these bugs w/o being detected by these tools.
If you see an integer overflow, think how the overflowed value used later (if it's used as allocation size,
or an array index). If you see an out-of-bounds read, think if it's followed by an out-of-bounds write as well.
Some KCSAN data-races may be exploitable by skilled attackers as well. Think what data structures got corrupted
as the result of data races and how. However, note that kernel has lots of "benign" data races that don't lead
to any runtime misbehavior at all.
* Denial Of Service:
Determine if the bug can result in denial-of-service. Most bugs can, since they cause system crash,
hangs, deadlocks, or resource leaks. This is mostly applicable to WARNING bugs that won't cause system crash
in production. For these think what will be consequences of the violation of the kernel assumptions flagged
by the WARNING. In some cases the unexpected condition is also properly handled by the normal control flow
(e.g. with "if (WARN_ON(...))"), these won't cause denial-of-service. If the condition is not handled,
then it may or may not cause denial-of-service.
* Accessible From Unprivileged Processes:
Determine if the bug can be reached from a typical (non-root) user process that does NOT have any special capabilities
(like CAP_SYS_ADMIN, CAP_NET_ADMIN, CAP_NET_RAW, CAP_PERFMON) or access to device nodes restricted to root.
Assume that unprivileged_bpf_disabled=1, that is eBPF loading is not accessible. However, cBPF (classical BPF)
is still accessible to non-root processes.
Assume that user namespaces are not accessible, that is, the process cannot get the mentioned capabilities even
within a new user namespace (checked by ns_capable() function in the kernel sources).
* Accessible From User Namespaces:
Determine if the bug can be reached within a user-namespace where the process has all capabilities
(including CAP_SYS_ADMIN, CAP_NET_ADMIN, CAP_NET_RAW, CAP_PERFMON). Such capabilities are checked with ns_capable()
function in the kernel sources.
* VM Guest Trigger:
Determine if the bug can be triggered from the context of a typical KVM guest (e.g., set up by a QEMU VMM).
Consider accesses to standard Linux host paravirtualized features (virtio-blk, virtio-net, etc.),
and handling of VM exits in the KVM code.
* VM Host Trigger in The Confidetial Computing Context:
Determine if the bug can be triggered in a confidential computing guest kernel from the context of a KVM host.
Consider access to standard Linux guest paravirtualized features (virtio-blk, virtio-net, etc.).
* Ethernet Network Trigger:
Determine if the bug can be triggered by processing ingress network Ethernet traffic, either directly (network stack)
or via drivers exposed to network data.
* Other Remote Trigger:
Determine if the bug can be triggered by processing remote traffic other than Ethernet (Wifi, Bluetooth, NFC, etc).
* Peripheral Trigger:
Determine if the bug can be triggered via an untrusted peripheral device that can be physically plugged
into a system, such as a USB device or a niche hardware driver handling external hardware inputs.
This is particularly important for mobile and desktop environments where users can plug in unknown devices.
* Malicious Filesystem Trigger:
Determine if the bug can be triggered by the kernel mounting and parsing a malicious filesystem image.
This is highly critical for Desktop and Mobile environments where external media or downloaded images
might be auto-mounted.
Don't make assumptions about the kernel source code (it may be different from what you assume it is).
Extensively use the provided code access tools (codesearch-*, git-*, grepper, etc)
to examine the actual source code, and confirm any assumptions.
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt:
The kernel bug report is:
slab gfs2_inode start ffff888047e8c8e0 pointer offset 304 size 1568
list_del corruption. prev->next should be ffffc9000e0bfae0, but was ffff888047e8ca10. (prev=ffff888047e8ca10)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:64!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5337 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:__list_del_entry_valid_or_report+0x15a/0x190 lib/list_debug.c:62
Code: e8 bb af 53 fd 43 80 3c 2c 00 74 08 4c 89 ff e8 ac a6 76 fd 49 8b 17 48 c7 c7 40 ec 27 8c 48 89 de 4c 89 f9 e8 e7 c8 6c fc 90 <0f> 0b 4c 89 f7 e8 8c af 53 fd 43 80 3c 2c 00 74 08 4c 89 ff e8 7d
RSP: 0018:ffffc9000e0bf970 EFLAGS: 00010046
RAX: 000000000000006d RBX: ffffc9000e0bfae0 RCX: 3d812020086e7500
RDX: 0000000000000000 RSI: 0000000080000002 RDI: 0000000000000000
RBP: ffffc9000e0bfbb0 R08: ffff88801fc247d3 R09: 1ffff11003f848fa
R10: dffffc0000000000 R11: ffffed1003f848fb R12: 1ffff11008fd1942
R13: dffffc0000000000 R14: ffff888047e8ca10 R15: ffff888047e8ca10
FS: 00007f4a2d5e16c0(0000) GS:ffff88808ca4c000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc66637ec0 CR3: 0000000033a4d000 CR4: 0000000000352ef0
Call Trace:
<TASK>
__list_del_entry_valid include/linux/list.h:132 [inline]
__list_del_entry include/linux/list.h:223 [inline]
list_del include/linux/list.h:237 [inline]
rwsem_try_write_lock kernel/locking/rwsem.c:662 [inline]
rwsem_down_write_slowpath+0x949/0x1040 kernel/locking/rwsem.c:1159
__down_write_common kernel/locking/rwsem.c:1317 [inline]
__down_write_killable kernel/locking/rwsem.c:1331 [inline]
down_write_killable+0x1eb/0x240 kernel/locking/rwsem.c:1603
inode_lock_killable include/linux/fs.h:1033 [inline]
chown_common+0x35e/0x6b0 fs/open.c:766
do_fchownat+0x14c/0x250 fs/open.c:806
__do_sys_fchownat fs/open.c:821 [inline]
__se_sys_fchownat fs/open.c:818 [inline]
__x64_sys_fchownat+0xb5/0xd0 fs/open.c:818
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4a2c79c819
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f4a2d5e0fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000104
RAX: ffffffffffffffda RBX: 00007f4a2ca16180 RCX: 00007f4a2c79c819
RDX: 00000000000043c0 RSI: 0000200000000000 RDI: ffffffffffffff9c
RBP: 00007f4a2c832c91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4a2ca16218 R14: 00007f4a2ca16180 R15: 00007ffc66638a58
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_del_entry_valid_or_report+0x15a/0x190 lib/list_debug.c:62
Code: e8 bb af 53 fd 43 80 3c 2c 00 74 08 4c 89 ff e8 ac a6 76 fd 49 8b 17 48 c7 c7 40 ec 27 8c 48 89 de 4c 89 f9 e8 e7 c8 6c fc 90 <0f> 0b 4c 89 f7 e8 8c af 53 fd 43 80 3c 2c 00 74 08 4c 89 ff e8 7d
RSP: 0018:ffffc9000e0bf970 EFLAGS: 00010046
RAX: 000000000000006d RBX: ffffc9000e0bfae0 RCX: 3d812020086e7500
RDX: 0000000000000000 RSI: 0000000080000002 RDI: 0000000000000000
RBP: ffffc9000e0bfbb0 R08: ffff88801fc247d3 R09: 1ffff11003f848fa
R10: dffffc0000000000 R11: ffffed1003f848fb R12: 1ffff11008fd1942
R13: dffffc0000000000 R14: ffff888047e8ca10 R15: ffff888047e8ca10
FS: 00007f4a2d5e16c0(0000) GS:ffff88808ca4c000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc66637ec0 CR3: 0000000033a4d000 CR4: 0000000000352ef0
Reply: Based on the analysis of the crash report and the kernel source code, here is the assessment of the bug:
### Root Cause Analysis
The crash is a `list_del` corruption occurring in `rwsem_try_write_lock` while a task is executing `chown_common`. The corrupted list is `inode->i_rwsem.wait_list`.
The sequence of events leading to the crash is as follows:
1. In `gfs2_create_inode`, the newly created inode is exposed to the VFS prematurely by calling `d_instantiate(dentry, inode)` **before** calling `unlock_new_inode(inode)`.
2. Because the dentry is now visible in the dcache, another concurrent task (e.g., an unprivileged user running `chown` on the newly created directory) can look it up and call `inode_lock_killable(inode)`.
3. The concurrent task acquires or waits on the `inode->i_rwsem`, adding its `waiter` struct to the `wait_list`.
4. Meanwhile, the original task in `gfs2_create_inode` continues and finally calls `unlock_new_inode(inode)`.
5. `unlock_new_inode` calls `lockdep_annotate_inode_mutex_key(inode)`. For directories, this function assumes no one is holding the lock yet and explicitly reinitializes it by calling `init_rwsem(&inode->i_rwsem)`.
6. This reinitialization clears the `wait_list` (setting `prev` and `next` to point to the list head itself).
7. When the concurrent task wakes up and tries to remove its `waiter` from the list via `list_del()`, it detects that the list head does not point back to the `waiter`, triggering the `list_del corruption` BUG.
### Security Impact in Production Builds
While this causes a kernel BUG and a Denial of Service in the syzkaller environment, **it has zero security impact in production builds**.
The function responsible for reinitializing the lock, `lockdep_annotate_inode_mutex_key()`, is strictly a debugging feature. It is conditionally compiled and only does anything if `CONFIG_LOCKDEP` is enabled:
```c
#ifdef CONFIG_LOCKDEP
void lockdep_annotate_inode_mutex_key(struct inode *inode)
{
...
init_rwsem(&inode->i_rwsem);
...
}
#else
static inline void lockdep_annotate_inode_mutex_key(struct inode *inode) { }
#endif
```
In a standard production kernel without debugging tools enabled (i.e., `CONFIG_LOCKDEP` is disabled), `lockdep_annotate_inode_mutex_key` is an empty inline function. Consequently, `init_rwsem` is **never** called on the already-exposed inode, and the `wait_list` is never corrupted.
The concurrent task will simply acquire the `i_rwsem` and then safely block on the GFS2 internal glock (`ip->i_gl`), which is still correctly held by `gfs2_create_inode` until it finishes its setup. There is no memory corruption, no use-after-free, and no crash.
### Conclusion
This is a lockdep-induced false positive caused by a minor ordering issue in GFS2 (`d_instantiate` before `unlock_new_inode`). It is not exploitable and cannot cause a Denial of Service in production environments.
|
| 6/2 |
2026/05/24 08:17 |
llm |
expert |
0m
Model:
Tokens:
input: 7969
output: 23
thoughts: 553
Thoughts: **Analyzing a Kernel Bug: List Corruption in rwsem_try_write_lock**
Okay, so I'm looking at a kernel BUG, specifically a list corruption within `lib/list_debug.c:64`. The error message is clear: `list_del corruption. prev->next should be ffffc9000e0bfae0, but was ffff888047e8ca10. (prev=ffff888047e8ca10)`. This points to a problem with the `list_del` operation, indicating that the `prev->next` pointer in a doubly-linked list has been mangled.
The call trace gives me a good starting point. It shows the corruption happening within `rwsem_try_write_lock`, deep inside the `rwsem` locking mechanisms, specifically when acquiring a write lock. The trace reveals the progression: `rwsem_try_write_lock` calls down through `rwsem_down_write_slowpath`, `__down_write_common`, `__down_write_killable`, and ultimately `down_write_killable`. This is triggered during `inode_lock_killable`, which is called from within `chown_common`, specifically within the `do_fchownat` syscall path. This strongly suggests a race condition or incorrect locking within file ownership changes.
Crucially, the message includes the key: `slab gfs2_inode start ffff888047e8c8e0 pointer offset 304 size 1568`. This tells me that the corrupted list is *inside* a `gfs2_inode` object. Given my familiarity with the GFS2 filesystem, I know the structure of `gfs2_inode` and can look at the layout, to locate the member at offset 304, which is likely a list head. I need to examine the `gfs2_inode` structure definition to precisely determine which list is being corrupted, and the nature of the list. From there, I can analyze the surrounding code in `chown_common`, `inode_lock_killable`, and, especially, `rwsem_try_write_lock` and its associated functions, to understand how this list is being manipulated during the file ownership operations and identify the root cause, most likely a missed locking or incorrect synchronization. I need to isolate where this list is being touched, and identify the code paths that can lead to this state to find a race condition.
|
| 7/2 |
2026/05/24 08:17 |
tool |
codesearch-struct-layout |
0m
Args:
Results: map[Fields:[map[Name:i_inode OffsetBits:0 SizeBits:9152] map[Name:i_no_addr OffsetBits:9152 SizeBits:64] map[Name:i_no_formal_ino OffsetBits:9216 SizeBits:64] map[Name:i_generation OffsetBits:9280 SizeBits:64] map[Name:i_eattr OffsetBits:9344 SizeBits:64] map[Name:i_flags OffsetBits:9408 SizeBits:64] map[Name:i_gl OffsetBits:9472 SizeBits:64] map[Name:i_iopen_gh OffsetBits:9536 SizeBits:448] map[Name:i_qadata OffsetBits:9984 SizeBits:64] map[Name:i_rgd_gh OffsetBits:10048 SizeBits:448] map[Name:i_res OffsetBits:10496 SizeBits:384] map[Name:i_goal OffsetBits:10880 SizeBits:64] map[Name:i_sizehint OffsetBits:10944 SizeBits:32] map[Name:i_rw_mutex OffsetBits:11008 SizeBits:1216] map[Name:i_ordered OffsetBits:12224 SizeBits:128] map[Name:i_hash_cache OffsetBits:12352 SizeBits:64] map[Name:i_entries OffsetBits:12416 SizeBits:32] map[Name:i_diskflags OffsetBits:12448 SizeBits:32] map[Name:i_height OffsetBits:12480 SizeBits:8] map[Name:i_depth OffsetBits:12488 SizeBits:8] map[Name:i_rahead OffsetBits:12496 SizeBits:16]]]
|
| 8/2 |
2026/05/24 08:17 |
llm |
expert |
0m
Model:
Tokens:
input: 9599
output: 19
thoughts: 88
Thoughts: **Analyzing the Inode Structure**
Okay, so I'm looking at this data structure, and the offset I'm interested in is 304 bytes. Now, let's convert that to bits real quick; 304 bytes times 8 bits per byte equals 2432 bits. Hold on, something seems off. The `i_inode` field, which I know is a struct inode, actually starts at an offset of 0, as you'd expect, but its *size* is listed as 9152 bits, or 1144 bytes. This means my offset of 304 bytes is definitely *inside* the `i_inode` structure. I need to understand what's at that specific offset to make any sense of this. Time to dig into the `struct inode` layout and figure out what fields reside where. I have to verify where this offset leads in the inode structure.
|
| 9/2 |
2026/05/24 08:17 |
tool |
codesearch-struct-layout |
0m
Args:
Results: map[Fields:[map[Name:i_mode OffsetBits:0 SizeBits:16] map[Name:i_opflags OffsetBits:16 SizeBits:16] map[Name:i_flags OffsetBits:32 SizeBits:32] map[Name:i_acl OffsetBits:64 SizeBits:64] map[Name:i_default_acl OffsetBits:128 SizeBits:64] map[Name:i_uid OffsetBits:192 SizeBits:32] map[Name:i_gid OffsetBits:224 SizeBits:32] map[Name:i_op OffsetBits:256 SizeBits:64] map[Name:i_sb OffsetBits:320 SizeBits:64] map[Name:i_mapping OffsetBits:384 SizeBits:64] map[Name:i_security OffsetBits:448 SizeBits:64] map[Name:i_ino OffsetBits:512 SizeBits:64] map[Name: OffsetBits:576 SizeBits:32] map[Name:i_rdev OffsetBits:608 SizeBits:32] map[Name:i_size OffsetBits:640 SizeBits:64] map[Name:i_atime_sec OffsetBits:704 SizeBits:64] map[Name:i_mtime_sec OffsetBits:768 SizeBits:64] map[Name:i_ctime_sec OffsetBits:832 SizeBits:64] map[Name:i_atime_nsec OffsetBits:896 SizeBits:32] map[Name:i_mtime_nsec OffsetBits:928 SizeBits:32] map[Name:i_ctime_nsec OffsetBits:960 SizeBits:32] map[Name:i_generation OffsetBits:992 SizeBits:32] map[Name:i_lock OffsetBits:1024 SizeBits:512] map[Name:i_bytes OffsetBits:1536 SizeBits:16] map[Name:i_blkbits OffsetBits:1552 SizeBits:8] map[Name:i_write_hint OffsetBits:1560 SizeBits:8] map[Name:i_blocks OffsetBits:1600 SizeBits:64] map[Name:i_state OffsetBits:1664 SizeBits:32] map[Name:i_rwsem OffsetBits:1728 SizeBits:1216] map[Name:dirtied_when OffsetBits:2944 SizeBits:64] map[Name:dirtied_time_when OffsetBits:3008 SizeBits:64] map[Name:i_hash OffsetBits:3072 SizeBits:128] map[Name:i_io_list OffsetBits:3200 SizeBits:128] map[Name:i_wb OffsetBits:3328 SizeBits:64] map[Name:i_wb_frn_winner OffsetBits:3392 SizeBits:32] map[Name:i_wb_frn_avg_time OffsetBits:3424 SizeBits:16] map[Name:i_wb_frn_history OffsetBits:3440 SizeBits:16] map[Name:i_lru OffsetBits:3456 SizeBits:128] map[Name:i_sb_list OffsetBits:3584 SizeBits:128] map[Name:i_wb_list OffsetBits:3712 SizeBits:128] map[Name: OffsetBits:3840 SizeBits:128] map[Name:i_version OffsetBits:3968 SizeBits:64] map[Name:i_sequence OffsetBits:4032 SizeBits:64] map[Name:i_count OffsetBits:4096 SizeBits:32] map[Name:i_dio_count OffsetBits:4128 SizeBits:32] map[Name:i_writecount OffsetBits:4160 SizeBits:32] map[Name:i_readcount OffsetBits:4192 SizeBits:32] map[Name: OffsetBits:4224 SizeBits:64] map[Name:i_flctx OffsetBits:4288 SizeBits:64] map[Name:i_data OffsetBits:4352 SizeBits:4416] map[Name: OffsetBits:8768 SizeBits:128] map[Name: OffsetBits:8896 SizeBits:64] map[Name:i_fsnotify_mask OffsetBits:8960 SizeBits:32] map[Name:i_fsnotify_marks OffsetBits:9024 SizeBits:64] map[Name:i_private OffsetBits:9088 SizeBits:64]]]
|
| 10/2 |
2026/05/24 08:17 |
llm |
expert |
0m
Model:
Tokens:
input: 11161
output: 21
thoughts: 102
Thoughts: **Analyzing Memory Layout**
Okay, so I'm looking at this memory layout and I need to figure out what's going on at a particular offset. I've got this offset of 2432 bits and I need to see where it sits in relation to `i_rwsem`. I remember that `i_rwsem` starts at bit 1728 and I know its size is 1216 bits.
Now, if I add those two, 1728 plus 1216, that comes out to 2944. Hmmm...2432 is definitely less than 2944, so that means this offset of 2432 is, in fact, *inside* the `i_rwsem` structure.
Okay, let's figure out where. Subtracting the starting bit of `i_rwsem` (1728) from the target offset (2432), I get 704 bits. That equates to 88 bytes. So, that's the *relative* offset within `i_rwsem`. Now, I really need to check the definition of the `struct rw_semaphore` to see what fields are at that offset. Time to look up that structure definition to see what's actually there.
|
| 11/2 |
2026/05/24 08:17 |
tool |
codesearch-struct-layout |
0m
Args:
Results: map[Fields:[map[Name:count OffsetBits:0 SizeBits:64] map[Name:owner OffsetBits:64 SizeBits:64] map[Name:osq OffsetBits:128 SizeBits:32] map[Name:wait_lock OffsetBits:192 SizeBits:512] map[Name:wait_list OffsetBits:704 SizeBits:128] map[Name:magic OffsetBits:832 SizeBits:64] map[Name:dep_map OffsetBits:896 SizeBits:320]]]
|
| 12/2 |
2026/05/24 08:17 |
llm |
expert |
0m
Model:
Tokens:
input: 11720
output: 45
thoughts: 322
Thoughts: **Analyzing a Read-Write Semaphore Corruption**
Okay, so I've got a bit of a puzzle here. The system's reporting a corrupted list β specifically, the `wait_list` within an `i_rwsem` structure inside a `struct inode`. I know this from the offset, 704 bits or 88 bytes, that corresponds to the structure's `wait_list` member. The error is occurring during a `list_del` call on an entry within that `wait_list`. The call stack points to the heart of the issue: the `rwsem_try_write_lock` function.
Now, that's interesting. I wouldn't immediately expect `rwsem_try_write_lock` to be directly involved in list manipulation. Let's see... the stack traces out to `chown_common`, which eventually leads to the locking of the `inode` using `down_write_killable`. So, *something* within that write path, starting with `rwsem_try_write_lock`, is likely where the corruption originates. My next step is clear: I need to dig into the `rwsem_try_write_lock` function in `kernel/locking/rwsem.c`. It's time to examine the code and determine how it interacts with the list. I need to understand why it might be calling `list_del` and how that could lead to corruption in this scenario. This looks like a race condition or incorrect list handling within the semaphore logic itself.
|
| 13/2 |
2026/05/24 08:17 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:kernel/locking/rwsem.c IncludeLines:true Name:rwsem_try_write_lock]
Results: map[SourceCode: 596: /*
597: * This function must be called with the sem->wait_lock held to prevent
598: * race conditions between checking the rwsem wait list and setting the
599: * sem->count accordingly.
600: *
601: * Implies rwsem_del_waiter() on success.
602: */
603: static inline bool rwsem_try_write_lock(struct rw_semaphore *sem,
604: struct rwsem_waiter *waiter)
605: {
606: struct rwsem_waiter *first = rwsem_first_waiter(sem);
607: long count, new;
608:
609: lockdep_assert_held(&sem->wait_lock);
610:
611: count = atomic_long_read(&sem->count);
612: do {
613: bool has_handoff = !!(count & RWSEM_FLAG_HANDOFF);
614:
615: if (has_handoff) {
616: /*
617: * Honor handoff bit and yield only when the first
618: * waiter is the one that set it. Otherwisee, we
619: * still try to acquire the rwsem.
620: */
621: if (first->handoff_set && (waiter != first))
622: return false;
623: }
624:
625: new = count;
626:
627: if (count & RWSEM_LOCK_MASK) {
628: /*
629: * A waiter (first or not) can set the handoff bit
630: * if it is an RT task or wait in the wait queue
631: * for too long.
632: */
633: if (has_handoff || (!rt_or_dl_task(waiter->task) &&
634: !time_after(jiffies, waiter->timeout)))
635: return false;
636:
637: new |= RWSEM_FLAG_HANDOFF;
638: } else {
639: new |= RWSEM_WRITER_LOCKED;
640: new &= ~RWSEM_FLAG_HANDOFF;
641:
642: if (list_is_singular(&sem->wait_list))
643: new &= ~RWSEM_FLAG_WAITERS;
644: }
645: } while (!atomic_long_try_cmpxchg_acquire(&sem->count, &count, new));
646:
647: /*
648: * We have either acquired the lock with handoff bit cleared or set
649: * the handoff bit. Only the first waiter can have its handoff_set
650: * set here to enable optimistic spinning in slowpath loop.
651: */
652: if (new & RWSEM_FLAG_HANDOFF) {
653: first->handoff_set = true;
654: lockevent_inc(rwsem_wlock_handoff);
655: return false;
656: }
657:
658: /*
659: * Have rwsem_try_write_lock() fully imply rwsem_del_waiter() on
660: * success.
661: */
662: list_del(&waiter->list);
663: rwsem_set_owner(sem);
664: return true;
665: }
SourceFile:kernel/locking/rwsem.c]
|
| 14/2 |
2026/05/24 08:17 |
llm |
expert |
0m
Model:
Tokens:
input: 13456
output: 46
thoughts: 53
Thoughts: Here's my analysis of what's happening, based on the snippet provided:
**Analyzing the Write Semaphore Down Slow Path**
Okay, so we've hit a point where `list_del(&waiter->list)` is being called. That suggests we're in the slow path of a write semaphore acquisition, which is what I'd expect given the context. The crucial detail here is that `waiter` is *allocated on the stack* within `rwsem_down_write_slowpath`. This immediately triggers certain questions in my mind, concerning memory management, potential race conditions, and how the `waiter` structure is being used within the larger locking mechanism. It means that the `waiter` is likely a temporary structure, used during this particular acquisition attempt, and that's a key observation. Now I need to dive deeper and see exactly how `rwsem_down_write_slowpath` handles this stack-allocated `waiter`. Understanding the purpose of that struct and how its linked list is manipulated will be critical to grasping the overall flow. I need to refresh myself on the details of the function now. Let's dig into `rwsem_down_write_slowpath` itself and see how this all fits together.
|
| 15/2 |
2026/05/24 08:17 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:kernel/locking/rwsem.c IncludeLines:true Name:rwsem_down_write_slowpath]
Results: map[SourceCode:1107: /*
1108: * Wait until we successfully acquire the write lock
1109: */
1110: static struct rw_semaphore __sched *
1111: rwsem_down_write_slowpath(struct rw_semaphore *sem, int state)
1112: {
1113: struct rwsem_waiter waiter;
1114: DEFINE_WAKE_Q(wake_q);
1115:
1116: /* do optimistic spinning and steal lock if possible */
1117: if (rwsem_can_spin_on_owner(sem) && rwsem_optimistic_spin(sem)) {
1118: /* rwsem_optimistic_spin() implies ACQUIRE on success */
1119: return sem;
1120: }
1121:
1122: /*
1123: * Optimistic spinning failed, proceed to the slowpath
1124: * and block until we can acquire the sem.
1125: */
1126: waiter.task = current;
1127: waiter.type = RWSEM_WAITING_FOR_WRITE;
1128: waiter.timeout = jiffies + RWSEM_WAIT_TIMEOUT;
1129: waiter.handoff_set = false;
1130:
1131: raw_spin_lock_irq(&sem->wait_lock);
1132: rwsem_add_waiter(sem, &waiter);
1133:
1134: /* we're now waiting on the lock */
1135: if (rwsem_first_waiter(sem) != &waiter) {
1136: rwsem_cond_wake_waiter(sem, atomic_long_read(&sem->count),
1137: &wake_q);
1138: if (!wake_q_empty(&wake_q)) {
1139: /*
1140: * We want to minimize wait_lock hold time especially
1141: * when a large number of readers are to be woken up.
1142: */
1143: raw_spin_unlock_irq(&sem->wait_lock);
1144: wake_up_q(&wake_q);
1145: raw_spin_lock_irq(&sem->wait_lock);
1146: }
1147: } else {
1148: atomic_long_or(RWSEM_FLAG_WAITERS, &sem->count);
1149: }
1150:
1151: /* wait until we successfully acquire the lock */
1152: set_current_state(state);
1153: trace_contention_begin(sem, LCB_F_WRITE);
1154:
1155: if (state == TASK_UNINTERRUPTIBLE)
1156: hung_task_set_blocker(sem, BLOCKER_TYPE_RWSEM_WRITER);
1157:
1158: for (;;) {
1159: if (rwsem_try_write_lock(sem, &waiter)) {
1160: /* rwsem_try_write_lock() implies ACQUIRE on success */
1161: break;
1162: }
1163:
1164: raw_spin_unlock_irq(&sem->wait_lock);
1165:
1166: if (signal_pending_state(state, current))
1167: goto out_nolock;
1168:
1169: /*
1170: * After setting the handoff bit and failing to acquire
1171: * the lock, attempt to spin on owner to accelerate lock
1172: * transfer. If the previous owner is a on-cpu writer and it
1173: * has just released the lock, OWNER_NULL will be returned.
1174: * In this case, we attempt to acquire the lock again
1175: * without sleeping.
1176: */
1177: if (waiter.handoff_set) {
1178: enum owner_state owner_state;
1179:
1180: owner_state = rwsem_spin_on_owner(sem);
1181: if (owner_state == OWNER_NULL)
1182: goto trylock_again;
1183: }
1184:
1185: schedule_preempt_disabled();
1186: lockevent_inc(rwsem_sleep_writer);
1187: set_current_state(state);
1188: trylock_again:
1189: raw_spin_lock_irq(&sem->wait_lock);
1190: }
1191:
1192: if (state == TASK_UNINTERRUPTIBLE)
1193: hung_task_clear_blocker();
1194:
1195: __set_current_state(TASK_RUNNING);
1196: raw_spin_unlock_irq(&sem->wait_lock);
1197: lockevent_inc(rwsem_wlock);
1198: trace_contention_end(sem, 0);
1199: return sem;
1200:
1201: out_nolock:
1202: __set_current_state(TASK_RUNNING);
1203: raw_spin_lock_irq(&sem->wait_lock);
1204: rwsem_del_wake_waiter(sem, &waiter, &wake_q);
1205: lockevent_inc(rwsem_wlock_fail);
1206: trace_contention_end(sem, -EINTR);
1207: return ERR_PTR(-EINTR);
1208: }
SourceFile:kernel/locking/rwsem.c]
|
| 16/2 |
2026/05/24 08:17 |
llm |
expert |
0m
Model:
Tokens:
input: 15410
output: 29
thoughts: 450
Thoughts: **Debugging a Corrupted List: `rwsem_try_write_lock` Edition**
Okay, so I'm looking at this bug, and it seems like the problem centers around a list corruption within `rwsem_try_write_lock`. The crux of it is that the list is messed up. Specifically, the `prev->next` pointer should be pointing to `waiter.list` at address `ffffc9000e0bfae0`, but it's incorrectly set to `ffff888047e8ca10`, which happens to be the address of `sem->wait_list`. Hmm, now that I think about it, `prev` *is* actually `sem->wait_list`! That means `sem->wait_list.next` is pointing back to itself, essentially making the list look empty.
But here's the kicker: the `waiter.list.prev` pointer *does* point to `sem->wait_list`. So, `waiter` *thinks* it's in the list, but the list itself thinks it's empty! This screams of someone removing `waiter` from the list without holding `sem->wait_lock`, a list reinitialization, or some good old-fashioned memory corruption.
Wait a second...I'm seeing something interesting. The `gfs2_inode` struct is located at `ffff888047e8c8e0`, and `sem->wait_list` is at `ffff888047e8ca10`. If I subtract the two addresses, the difference is 0x130, which is 304 bytes. So, `sem->wait_list` is located 304 bytes into the `gfs2_inode` struct. This is significant, and I know from prior experience, that this could mean the `gfs2_inode` itself was freed and reallocated while a task was waiting on its `i_rwsem`! Or, potentially, `i_rwsem` was reinitialized somehow?
The key now is to figure out if `gfs2_inode` can actually be freed while someone is waiting on its `i_rwsem`. That seems like the most likely scenario. Or, is `i_rwsem` being reinitialized somehow? I need to trace back where the `gfs2_inode` is allocated and initialized. That's where I should start looking for the root cause.
|
| 17/2 |
2026/05/24 08:17 |
tool |
codesearch-find-references |
0m
Args: map[IncludeSnippetLines:0 Name:gfs2_inode]
Results: map[References:[map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:GFS2_I SourceFile:fs/gfs2/incore.h SourceLine:418] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:GFS2_I SourceFile:fs/gfs2/incore.h SourceLine:418] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:GFS2_I SourceFile:fs/gfs2/incore.h SourceLine:418] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:__bpf_trace_gfs2_block_alloc SourceFile:fs/gfs2/trace_gfs2.h SourceLine:551] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:__bpf_trace_gfs2_bmap SourceFile:fs/gfs2/trace_gfs2.h SourceLine:442] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:__bpf_trace_gfs2_iomap_end SourceFile:fs/gfs2/trace_gfs2.h SourceLine:511] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:__bpf_trace_gfs2_iomap_start SourceFile:fs/gfs2/trace_gfs2.h SourceLine:481] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:__do_trace_gfs2_block_alloc SourceFile:fs/gfs2/trace_gfs2.h SourceLine:551] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:__do_trace_gfs2_bmap SourceFile:fs/gfs2/trace_gfs2.h SourceLine:442] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:__do_trace_gfs2_iomap_end SourceFile:fs/gfs2/trace_gfs2.h SourceLine:511] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:__do_trace_gfs2_iomap_start SourceFile:fs/gfs2/trace_gfs2.h SourceLine:481] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:__fillup_metapath SourceFile:fs/gfs2/bmap.c SourceLine:324] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:__gfs2_fallocate SourceFile:fs/gfs2/file.c SourceLine:1256] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:__gfs2_free_blocks SourceFile:fs/gfs2/rgrp.c SourceLine:2517] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:__gfs2_get_acl SourceFile:fs/gfs2/acl.c SourceLine:42] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:__gfs2_iomap_alloc SourceFile:fs/gfs2/bmap.c SourceLine:664] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:__gfs2_iomap_get SourceFile:fs/gfs2/bmap.c SourceLine:844] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:__gfs2_jdata_write_folio SourceFile:fs/gfs2/aops.c SourceLine:105] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:__gfs2_punch_hole SourceFile:fs/gfs2/bmap.c SourceLine:2416] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:__gfs2_unstuff_inode SourceFile:fs/gfs2/bmap.c SourceLine:90] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:__gfs2_xattr_get SourceFile:fs/gfs2/xattr.c SourceLine:584] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:__gfs2_xattr_set SourceFile:fs/gfs2/xattr.c SourceLine:1175] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:__ordered_del_inode SourceFile:fs/gfs2/log.c SourceLine:708] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:__probestub_gfs2_block_alloc SourceFile:fs/gfs2/trace_gfs2.h SourceLine:551] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:__probestub_gfs2_bmap SourceFile:fs/gfs2/trace_gfs2.h SourceLine:442] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:__probestub_gfs2_iomap_end SourceFile:fs/gfs2/trace_gfs2.h SourceLine:511] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:__probestub_gfs2_iomap_start SourceFile:fs/gfs2/trace_gfs2.h SourceLine:481] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:__traceiter_gfs2_block_alloc SourceFile:fs/gfs2/trace_gfs2.h SourceLine:551] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:__traceiter_gfs2_block_alloc SourceFile:fs/gfs2/trace_gfs2.h SourceLine:551] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:__traceiter_gfs2_bmap SourceFile:fs/gfs2/trace_gfs2.h SourceLine:442] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:__traceiter_gfs2_bmap SourceFile:fs/gfs2/trace_gfs2.h SourceLine:442] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:__traceiter_gfs2_iomap_end SourceFile:fs/gfs2/trace_gfs2.h SourceLine:511] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:__traceiter_gfs2_iomap_end SourceFile:fs/gfs2/trace_gfs2.h SourceLine:511] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:__traceiter_gfs2_iomap_start SourceFile:fs/gfs2/trace_gfs2.h SourceLine:481] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:__traceiter_gfs2_iomap_start SourceFile:fs/gfs2/trace_gfs2.h SourceLine:481] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:adjust_fs_space SourceFile:fs/gfs2/aops.c SourceLine:512] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:alloc_dinode SourceFile:fs/gfs2/inode.c SourceLine:418] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:bh_get SourceFile:fs/gfs2/quota.c SourceLine:397] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:buf_lo_after_scan SourceFile:fs/gfs2/lops.c SourceLine:831] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:buf_lo_scan_elements SourceFile:fs/gfs2/lops.c SourceLine:778] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:calc_max_reserv SourceFile:fs/gfs2/file.c SourceLine:1230] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:check_and_update_goal SourceFile:fs/gfs2/rgrp.c SourceLine:601] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:check_journal_clean SourceFile:fs/gfs2/util.c SourceLine:58] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:check_trace_callback_type_gfs2_block_alloc SourceFile:fs/gfs2/trace_gfs2.h SourceLine:551] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:check_trace_callback_type_gfs2_bmap SourceFile:fs/gfs2/trace_gfs2.h SourceLine:442] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:check_trace_callback_type_gfs2_iomap_end SourceFile:fs/gfs2/trace_gfs2.h SourceLine:511] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:check_trace_callback_type_gfs2_iomap_start SourceFile:fs/gfs2/trace_gfs2.h SourceLine:481] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:create_ok SourceFile:fs/gfs2/inode.c SourceLine:374] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:databuf_lo_after_scan SourceFile:fs/gfs2/lops.c SourceLine:1051] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:databuf_lo_scan_elements SourceFile:fs/gfs2/lops.c SourceLine:1003] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:dir_double_exhash SourceFile:fs/gfs2/dir.c SourceLine:1148] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:dir_e_read SourceFile:fs/gfs2/dir.c SourceLine:1532] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:dir_make_exhash SourceFile:fs/gfs2/dir.c SourceLine:910] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:dir_new_leaf SourceFile:fs/gfs2/dir.c SourceLine:1727] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:dir_split_leaf SourceFile:fs/gfs2/dir.c SourceLine:1001] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:dirent_check_reclen SourceFile:fs/gfs2/dir.c SourceLine:608] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:dirent_del SourceFile:fs/gfs2/dir.c SourceLine:672] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:dirent_next SourceFile:fs/gfs2/dir.c SourceLine:637] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:do_filldir_main SourceFile:fs/gfs2/dir.c SourceLine:1264] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:do_flock SourceFile:fs/gfs2/file.c SourceLine:1489] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:do_gfs2_set_flags SourceFile:fs/gfs2/file.c SourceLine:221] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:do_glock SourceFile:fs/gfs2/quota.c SourceLine:1027] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:do_grow SourceFile:fs/gfs2/bmap.c SourceLine:2081] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:do_init_dirent SourceFile:fs/gfs2/dir.c SourceLine:715] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:do_perf_trace_gfs2_block_alloc SourceFile:fs/gfs2/trace_gfs2.h SourceLine:551] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:do_perf_trace_gfs2_bmap SourceFile:fs/gfs2/trace_gfs2.h SourceLine:442] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:do_perf_trace_gfs2_iomap_end SourceFile:fs/gfs2/trace_gfs2.h SourceLine:511] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:do_perf_trace_gfs2_iomap_start SourceFile:fs/gfs2/trace_gfs2.h SourceLine:481] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:do_perf_trace_gfs2_rs SourceFile:fs/gfs2/trace_gfs2.h SourceLine:595] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:do_perf_trace_gfs2_rs SourceFile:fs/gfs2/trace_gfs2.h SourceLine:595] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:do_perf_trace_gfs2_rs SourceFile:fs/gfs2/trace_gfs2.h SourceLine:595] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:do_qc SourceFile:fs/gfs2/quota.c SourceLine:676] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:do_shrink SourceFile:fs/gfs2/bmap.c SourceLine:2043] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:do_sync SourceFile:fs/gfs2/quota.c SourceLine:897] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:do_trace_event_raw_event_gfs2_block_alloc SourceFile:fs/gfs2/trace_gfs2.h SourceLine:551] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:do_trace_event_raw_event_gfs2_bmap SourceFile:fs/gfs2/trace_gfs2.h SourceLine:442] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:do_trace_event_raw_event_gfs2_iomap_end SourceFile:fs/gfs2/trace_gfs2.h SourceLine:511] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:do_trace_event_raw_event_gfs2_iomap_start SourceFile:fs/gfs2/trace_gfs2.h SourceLine:481] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:do_trace_event_raw_event_gfs2_rs SourceFile:fs/gfs2/trace_gfs2.h SourceLine:595] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:do_trace_event_raw_event_gfs2_rs SourceFile:fs/gfs2/trace_gfs2.h SourceLine:595] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:do_trace_event_raw_event_gfs2_rs SourceFile:fs/gfs2/trace_gfs2.h SourceLine:595] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:dump_rs SourceFile:fs/gfs2/rgrp.c SourceLine:622] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:dump_rs SourceFile:fs/gfs2/rgrp.c SourceLine:622] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:dump_rs SourceFile:fs/gfs2/rgrp.c SourceLine:622] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:dump_rs SourceFile:fs/gfs2/rgrp.c SourceLine:622] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:ea_alloc_blk SourceFile:fs/gfs2/xattr.c SourceLine:638] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:ea_alloc_skeleton SourceFile:fs/gfs2/xattr.c SourceLine:741] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:ea_dealloc_block SourceFile:fs/gfs2/xattr.c SourceLine:1386] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:ea_dealloc_indirect SourceFile:fs/gfs2/xattr.c SourceLine:1266] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:ea_dealloc_unstuffed SourceFile:fs/gfs2/xattr.c SourceLine:233] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:ea_find_i SourceFile:fs/gfs2/xattr.c SourceLine:179] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:ea_foreach SourceFile:fs/gfs2/xattr.c SourceLine:129] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:ea_foreach_i SourceFile:fs/gfs2/xattr.c SourceLine:88] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:ea_init SourceFile:fs/gfs2/xattr.c SourceLine:805] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:ea_init_i SourceFile:fs/gfs2/xattr.c SourceLine:782] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:ea_list_i SourceFile:fs/gfs2/xattr.c SourceLine:354] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:ea_remove_stuffed SourceFile:fs/gfs2/xattr.c SourceLine:1089] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:ea_remove_unstuffed SourceFile:fs/gfs2/xattr.c SourceLine:328] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:ea_set_block SourceFile:fs/gfs2/xattr.c SourceLine:971] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:ea_set_i SourceFile:fs/gfs2/xattr.c SourceLine:1045] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:ea_set_remove_stuffed SourceFile:fs/gfs2/xattr.c SourceLine:841] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:ea_set_remove_unstuffed SourceFile:fs/gfs2/xattr.c SourceLine:1077] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:ea_set_simple SourceFile:fs/gfs2/xattr.c SourceLine:924] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:ea_set_simple_alloc SourceFile:fs/gfs2/xattr.c SourceLine:902] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:ea_set_simple_noalloc SourceFile:fs/gfs2/xattr.c SourceLine:875] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:ea_write SourceFile:fs/gfs2/xattr.c SourceLine:678] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:evict_linked_inode SourceFile:fs/gfs2/super.c SourceLine:1335] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:evict_should_delete SourceFile:fs/gfs2/super.c SourceLine:1239] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:evict_unlinked_inode SourceFile:fs/gfs2/super.c SourceLine:1285] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:fallocate_chunk SourceFile:fs/gfs2/file.c SourceLine:1180] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:fillup_metapath SourceFile:fs/gfs2/bmap.c SourceLine:375] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:freeze_go_xmote_bh SourceFile:fs/gfs2/glops.c SourceLine:600] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:get_first_leaf SourceFile:fs/gfs2/dir.c SourceLine:796] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:get_leaf SourceFile:fs/gfs2/dir.c SourceLine:759] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:get_leaf_nr SourceFile:fs/gfs2/dir.c SourceLine:782] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_adjust_quota SourceFile:fs/gfs2/quota.c SourceLine:841] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_adjust_reservation SourceFile:fs/gfs2/rgrp.c SourceLine:2346] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_alloc_blocks SourceFile:fs/gfs2/rgrp.c SourceLine:2416] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_alloc_inode SourceFile:fs/gfs2/super.c SourceLine:1454] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_alloc_size SourceFile:fs/gfs2/bmap.c SourceLine:797] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_block_map SourceFile:fs/gfs2/bmap.c SourceLine:1231] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_bmap SourceFile:fs/gfs2/aops.c SourceLine:563] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_check_inum SourceFile:fs/gfs2/inode.h SourceLine:62] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_clear_glop_pending SourceFile:fs/gfs2/glops.c SourceLine:271] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_consist_inode_i SourceFile:fs/gfs2/util.c SourceLine:334] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_create_inode SourceFile:fs/gfs2/inode.c SourceLine:709] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_create_inode SourceFile:fs/gfs2/inode.c SourceLine:709] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_dentry_delete SourceFile:fs/gfs2/dentry.c SourceLine:83] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_dinode_dealloc SourceFile:fs/gfs2/inode.c SourceLine:474] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_dinode_in SourceFile:fs/gfs2/glops.c SourceLine:387] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_dinode_out SourceFile:fs/gfs2/super.c SourceLine:393] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_dir_add SourceFile:fs/gfs2/dir.c SourceLine:1797] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_dir_add SourceFile:fs/gfs2/dir.c SourceLine:1799] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_dir_check SourceFile:fs/gfs2/dir.c SourceLine:1675] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_dir_del SourceFile:fs/gfs2/dir.c SourceLine:1875] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_dir_exhash_dealloc SourceFile:fs/gfs2/dir.c SourceLine:2101] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_dir_get_existing_buffer SourceFile:fs/gfs2/dir.c SourceLine:103] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_dir_get_hash_table SourceFile:fs/gfs2/dir.c SourceLine:335] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_dir_get_new_buffer SourceFile:fs/gfs2/dir.c SourceLine:90] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_dir_hash_inval SourceFile:fs/gfs2/dir.c SourceLine:385] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_dir_mvino SourceFile:fs/gfs2/dir.c SourceLine:1937] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_dir_mvino SourceFile:fs/gfs2/dir.c SourceLine:1938] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_dir_read SourceFile:fs/gfs2/dir.c SourceLine:1571] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_dir_read_data SourceFile:fs/gfs2/dir.c SourceLine:268] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_dir_read_leaf SourceFile:fs/gfs2/dir.c SourceLine:1371] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_dir_read_stuffed SourceFile:fs/gfs2/dir.c SourceLine:244] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_dir_readahead SourceFile:fs/gfs2/dir.c SourceLine:1483] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_dir_write_data SourceFile:fs/gfs2/dir.c SourceLine:153] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_dir_write_stuffed SourceFile:fs/gfs2/dir.c SourceLine:120] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_diradd_alloc_required SourceFile:fs/gfs2/dir.c SourceLine:2160] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_dirent_search SourceFile:fs/gfs2/dir.c SourceLine:816] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_dirty_inode SourceFile:fs/gfs2/super.c SourceLine:484] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_drevalidate SourceFile:fs/gfs2/dentry.c SourceLine:39] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_drevalidate SourceFile:fs/gfs2/dentry.c SourceLine:42] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_drop_inode SourceFile:fs/gfs2/super.c SourceLine:1007] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_ea_dealloc SourceFile:fs/gfs2/xattr.c SourceLine:1443] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_ea_find SourceFile:fs/gfs2/xattr.c SourceLine:203] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_ea_get_copy SourceFile:fs/gfs2/xattr.c SourceLine:522] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_encode_fh SourceFile:fs/gfs2/export.c SourceLine:33] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_evict_inode SourceFile:fs/gfs2/super.c SourceLine:1385] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_exchange SourceFile:fs/gfs2/inode.c SourceLine:1740] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_exchange SourceFile:fs/gfs2/inode.c SourceLine:1741] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_exchange SourceFile:fs/gfs2/inode.c SourceLine:1742] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_exchange SourceFile:fs/gfs2/inode.c SourceLine:1743] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_fallocate SourceFile:fs/gfs2/file.c SourceLine:1372] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_fault SourceFile:fs/gfs2/file.c SourceLine:555] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_fiemap SourceFile:fs/gfs2/inode.c SourceLine:2206] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_file_buffered_write SourceFile:fs/gfs2/file.c SourceLine:1016] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_file_buffered_write SourceFile:fs/gfs2/file.c SourceLine:1052] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_file_dealloc SourceFile:fs/gfs2/bmap.c SourceLine:2184] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_file_direct_read SourceFile:fs/gfs2/file.c SourceLine:815] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_file_direct_write SourceFile:fs/gfs2/file.c SourceLine:879] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_file_read_iter SourceFile:fs/gfs2/file.c SourceLine:951] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_file_write_iter SourceFile:fs/gfs2/file.c SourceLine:1104] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_fileattr_get SourceFile:fs/gfs2/file.c SourceLine:161] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_final_release_pages SourceFile:fs/gfs2/inode.c SourceLine:456] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_free_di SourceFile:fs/gfs2/rgrp.c SourceLine:2574] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_free_meta SourceFile:fs/gfs2/rgrp.c SourceLine:2545] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_fsync SourceFile:fs/gfs2/file.c SourceLine:748] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_get_acl SourceFile:fs/gfs2/acl.c SourceLine:62] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_get_link SourceFile:fs/gfs2/inode.c SourceLine:1909] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_get_name SourceFile:fs/gfs2/export.c SourceLine:90] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_get_name SourceFile:fs/gfs2/export.c SourceLine:90] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_getattr SourceFile:fs/gfs2/inode.c SourceLine:2163] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_getjdatabuf SourceFile:fs/gfs2/meta_io.c SourceLine:410] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_glock2inode SourceFile:fs/gfs2/glops.c SourceLine:250] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_grab_existing_inode SourceFile:fs/gfs2/glock.c SourceLine:877] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_init_dir SourceFile:fs/gfs2/inode.c SourceLine:523] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_init_inode_once SourceFile:fs/gfs2/main.c SourceLine:36] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_init_xattr SourceFile:fs/gfs2/inode.c SourceLine:547] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_inode_lookup SourceFile:fs/gfs2/inode.c SourceLine:132] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_inode_ra_len SourceFile:fs/gfs2/dir.c SourceLine:1772] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_inode_refresh SourceFile:fs/gfs2/glops.c SourceLine:477] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_inplace_release SourceFile:fs/gfs2/rgrp.c SourceLine:2201] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_inplace_reserve SourceFile:fs/gfs2/rgrp.c SourceLine:2043] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_internal_read SourceFile:fs/gfs2/aops.c SourceLine:449] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_inum_out SourceFile:fs/gfs2/inode.h SourceLine:68] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_iomap_begin SourceFile:fs/gfs2/bmap.c SourceLine:1101] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_iomap_begin_write SourceFile:fs/gfs2/bmap.c SourceLine:1019] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_iomap_end SourceFile:fs/gfs2/bmap.c SourceLine:1152] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_iomap_get_folio SourceFile:fs/gfs2/bmap.c SourceLine:966] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_iomap_put_folio SourceFile:fs/gfs2/bmap.c SourceLine:991] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_is_dir SourceFile:fs/gfs2/inode.h SourceLine:40] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_is_jdata SourceFile:fs/gfs2/inode.h SourceLine:25] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_is_stuffed SourceFile:fs/gfs2/inode.h SourceLine:20] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_iter_unstuffed SourceFile:fs/gfs2/xattr.c SourceLine:457] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_jdata_writeback SourceFile:fs/gfs2/aops.c SourceLine:129] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_jdata_writepages SourceFile:fs/gfs2/aops.c SourceLine:364] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_jdesc_check SourceFile:fs/gfs2/super.c SourceLine:109] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_jindex_hold SourceFile:fs/gfs2/ops_fstype.c SourceLine:535] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_journal_wipe SourceFile:fs/gfs2/meta_io.c SourceLine:439] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_link SourceFile:fs/gfs2/inode.c SourceLine:1042] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_link SourceFile:fs/gfs2/inode.c SourceLine:1045] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_listxattr SourceFile:fs/gfs2/xattr.c SourceLine:418] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_llseek SourceFile:fs/gfs2/file.c SourceLine:60] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_lock SourceFile:fs/gfs2/file.c SourceLine:1442] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_lock_fs_check_clean SourceFile:fs/gfs2/super.c SourceLine:326] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_lookupi SourceFile:fs/gfs2/inode.c SourceLine:326] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_make_fs_rw SourceFile:fs/gfs2/super.c SourceLine:135] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_map_journal_extents SourceFile:fs/gfs2/bmap.c SourceLine:2263] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_max_stuffed_size SourceFile:fs/gfs2/incore.h SourceLine:876] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_meta_buffer SourceFile:fs/gfs2/meta_io.c SourceLine:483] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_meta_inode_buffer SourceFile:fs/gfs2/meta_io.h SourceLine:67] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_mmap SourceFile:fs/gfs2/file.c SourceLine:593] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_ok_to_move SourceFile:fs/gfs2/inode.c SourceLine:1416] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_ok_to_move SourceFile:fs/gfs2/inode.c SourceLine:1416] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_open SourceFile:fs/gfs2/file.c SourceLine:677] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_ordered_add_inode SourceFile:fs/gfs2/log.h SourceLine:47] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_ordered_del_inode SourceFile:fs/gfs2/log.c SourceLine:753] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_ordered_wait SourceFile:fs/gfs2/log.c SourceLine:738] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_ordered_wait SourceFile:fs/gfs2/log.c SourceLine:742] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_ordered_wait SourceFile:fs/gfs2/log.c SourceLine:742] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_ordered_wait SourceFile:fs/gfs2/log.c SourceLine:742] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_ordered_write SourceFile:fs/gfs2/log.c SourceLine:716] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_ordered_write SourceFile:fs/gfs2/log.c SourceLine:722] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_ordered_write SourceFile:fs/gfs2/log.c SourceLine:722] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_ordered_write SourceFile:fs/gfs2/log.c SourceLine:722] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_orlov_skip SourceFile:fs/gfs2/rgrp.c SourceLine:1987] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_page_mkwrite SourceFile:fs/gfs2/file.c SourceLine:420] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_permission SourceFile:fs/gfs2/inode.c SourceLine:1969] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_qa_get SourceFile:fs/gfs2/quota.c SourceLine:544] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_qa_put SourceFile:fs/gfs2/quota.c SourceLine:572] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_quota_change SourceFile:fs/gfs2/quota.c SourceLine:1284] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_quota_check SourceFile:fs/gfs2/quota.c SourceLine:1226] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_quota_hold SourceFile:fs/gfs2/quota.c SourceLine:584] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_quota_init SourceFile:fs/gfs2/quota.c SourceLine:1391] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_quota_lock SourceFile:fs/gfs2/quota.c SourceLine:1074] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_quota_lock_check SourceFile:fs/gfs2/quota.h SourceLine:40] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_quota_unhold SourceFile:fs/gfs2/quota.c SourceLine:643] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_quota_unlock SourceFile:fs/gfs2/quota.c SourceLine:1145] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_read_folio SourceFile:fs/gfs2/aops.c SourceLine:421] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_readahead SourceFile:fs/gfs2/aops.c SourceLine:495] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_readdir SourceFile:fs/gfs2/file.c SourceLine:108] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_recover_func SourceFile:fs/gfs2/recovery.c SourceLine:401] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_release SourceFile:fs/gfs2/file.c SourceLine:708] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_rename SourceFile:fs/gfs2/inode.c SourceLine:1488] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_rename SourceFile:fs/gfs2/inode.c SourceLine:1489] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_rename SourceFile:fs/gfs2/inode.c SourceLine:1490] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_rename SourceFile:fs/gfs2/inode.c SourceLine:1491] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_replay_read_block SourceFile:fs/gfs2/recovery.c SourceLine:35] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_rg_blocks SourceFile:fs/gfs2/trans.h SourceLine:28] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_ri_total SourceFile:fs/gfs2/rgrp.c SourceLine:845] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_ri_update SourceFile:fs/gfs2/rgrp.c SourceLine:995] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_rindex_update SourceFile:fs/gfs2/rgrp.c SourceLine:1036] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_rlist_add SourceFile:fs/gfs2/rgrp.c SourceLine:2658] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_rs_delete SourceFile:fs/gfs2/rgrp.c SourceLine:685] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_seek_data SourceFile:fs/gfs2/inode.c SourceLine:2236] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_seek_hole SourceFile:fs/gfs2/inode.c SourceLine:2255] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_set_acl SourceFile:fs/gfs2/acl.c SourceLine:109] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_set_alloc_start SourceFile:fs/gfs2/rgrp.c SourceLine:2388] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_set_dqblk SourceFile:fs/gfs2/quota.c SourceLine:1705] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_set_inode_flags SourceFile:fs/gfs2/file.c SourceLine:186] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_setattr SourceFile:fs/gfs2/inode.c SourceLine:2101] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_setattr_size SourceFile:fs/gfs2/bmap.c SourceLine:2148] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_size_hint SourceFile:fs/gfs2/file.c SourceLine:371] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_statfs_change SourceFile:fs/gfs2/super.c SourceLine:219] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_statfs_init SourceFile:fs/gfs2/super.c SourceLine:179] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_statfs_sync SourceFile:fs/gfs2/super.c SourceLine:269] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_trans_da_blks SourceFile:fs/gfs2/inode.c SourceLine:621] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_truncatei_resume SourceFile:fs/gfs2/bmap.c SourceLine:2175] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_try_to_evict SourceFile:fs/gfs2/glock.c SourceLine:896] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_unlink SourceFile:fs/gfs2/inode.c SourceLine:1244] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_unlink SourceFile:fs/gfs2/inode.c SourceLine:1247] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_unlink_di SourceFile:fs/gfs2/rgrp.c SourceLine:2557] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_unlink_inode SourceFile:fs/gfs2/inode.c SourceLine:1207] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_unlink_inode SourceFile:fs/gfs2/inode.c SourceLine:1211] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_unlink_ok SourceFile:fs/gfs2/inode.c SourceLine:1172] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_unlink_ok SourceFile:fs/gfs2/inode.c SourceLine:1173] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_unstuff_dinode SourceFile:fs/gfs2/bmap.c SourceLine:155] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_unstuffer_folio SourceFile:fs/gfs2/bmap.c SourceLine:54] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_update_time SourceFile:fs/gfs2/inode.c SourceLine:2274] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_upgrade_iopen_glock SourceFile:fs/gfs2/super.c SourceLine:1177] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_walk_metadata SourceFile:fs/gfs2/bmap.c SourceLine:472] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_write_alloc_required SourceFile:fs/gfs2/bmap.c SourceLine:2316] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_write_buf_to_page SourceFile:fs/gfs2/quota.c SourceLine:729] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_write_calc_reserv SourceFile:fs/gfs2/bmap.h SourceLine:28] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_write_inode SourceFile:fs/gfs2/super.c SourceLine:441] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_xattr_acl_get SourceFile:fs/gfs2/xattr.c SourceLine:540] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_xattr_get SourceFile:fs/gfs2/xattr.c SourceLine:611] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_xattr_remove SourceFile:fs/gfs2/xattr.c SourceLine:1134] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:gfs2_xattr_set SourceFile:fs/gfs2/xattr.c SourceLine:1237] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:init_dinode SourceFile:fs/gfs2/inode.c SourceLine:574] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:init_dinode SourceFile:fs/gfs2/inode.c SourceLine:574] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:init_journal SourceFile:fs/gfs2/ops_fstype.c SourceLine:698] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:init_per_node SourceFile:fs/gfs2/ops_fstype.c SourceLine:894] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:init_statfs SourceFile:fs/gfs2/ops_fstype.c SourceLine:612] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:inode_go_dump SourceFile:fs/gfs2/glops.c SourceLine:546] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:inode_go_held SourceFile:fs/gfs2/glops.c SourceLine:518] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:inode_go_instantiate SourceFile:fs/gfs2/glops.c SourceLine:500] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:inode_go_inval SourceFile:fs/gfs2/glops.c SourceLine:360] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:inode_go_sync SourceFile:fs/gfs2/glops.c SourceLine:305] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:iopen_go_callback SourceFile:fs/gfs2/glops.c SourceLine:628] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:ip_cmp SourceFile:fs/gfs2/log.c SourceLine:696] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:ip_cmp SourceFile:fs/gfs2/log.c SourceLine:696] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:ip_cmp SourceFile:fs/gfs2/log.c SourceLine:698] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:ip_cmp SourceFile:fs/gfs2/log.c SourceLine:698] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:ip_cmp SourceFile:fs/gfs2/log.c SourceLine:698] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:ip_cmp SourceFile:fs/gfs2/log.c SourceLine:699] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:ip_cmp SourceFile:fs/gfs2/log.c SourceLine:699] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:ip_cmp SourceFile:fs/gfs2/log.c SourceLine:699] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:leaf_dealloc SourceFile:fs/gfs2/dir.c SourceLine:1973] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:link_dinode SourceFile:fs/gfs2/inode.c SourceLine:629] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:link_dinode SourceFile:fs/gfs2/inode.c SourceLine:630] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:lookup_metapath SourceFile:fs/gfs2/bmap.c SourceLine:359] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:munge_mode_uid_gid SourceFile:fs/gfs2/inode.c SourceLine:396] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:new_leaf SourceFile:fs/gfs2/dir.c SourceLine:866] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:perf_trace_gfs2_block_alloc SourceFile:fs/gfs2/trace_gfs2.h SourceLine:551] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:perf_trace_gfs2_bmap SourceFile:fs/gfs2/trace_gfs2.h SourceLine:442] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:perf_trace_gfs2_iomap_end SourceFile:fs/gfs2/trace_gfs2.h SourceLine:511] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:perf_trace_gfs2_iomap_start SourceFile:fs/gfs2/trace_gfs2.h SourceLine:481] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:punch_hole SourceFile:fs/gfs2/bmap.c SourceLine:1731] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:read_rindex_entry SourceFile:fs/gfs2/rgrp.c SourceLine:895] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:register_trace_gfs2_block_alloc SourceFile:fs/gfs2/trace_gfs2.h SourceLine:551] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:register_trace_gfs2_bmap SourceFile:fs/gfs2/trace_gfs2.h SourceLine:442] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:register_trace_gfs2_iomap_end SourceFile:fs/gfs2/trace_gfs2.h SourceLine:511] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:register_trace_gfs2_iomap_start SourceFile:fs/gfs2/trace_gfs2.h SourceLine:481] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:register_trace_prio_gfs2_block_alloc SourceFile:fs/gfs2/trace_gfs2.h SourceLine:551] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:register_trace_prio_gfs2_bmap SourceFile:fs/gfs2/trace_gfs2.h SourceLine:442] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:register_trace_prio_gfs2_iomap_end SourceFile:fs/gfs2/trace_gfs2.h SourceLine:511] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:register_trace_prio_gfs2_iomap_start SourceFile:fs/gfs2/trace_gfs2.h SourceLine:481] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:rg_mblk_search SourceFile:fs/gfs2/rgrp.c SourceLine:1562] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:rs_insert SourceFile:fs/gfs2/rgrp.c SourceLine:1488] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:setattr_chown SourceFile:fs/gfs2/inode.c SourceLine:2025] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:stuffed_read_folio SourceFile:fs/gfs2/aops.c SourceLine:384] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:stuffed_zero_range SourceFile:fs/gfs2/bmap.c SourceLine:2358] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:sweep_bh_for_rgrps SourceFile:fs/gfs2/bmap.c SourceLine:1471] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:trace_event_get_offsets_gfs2_block_alloc SourceFile:fs/gfs2/trace_gfs2.h SourceLine:551] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:trace_event_get_offsets_gfs2_bmap SourceFile:fs/gfs2/trace_gfs2.h SourceLine:442] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:trace_event_get_offsets_gfs2_iomap_end SourceFile:fs/gfs2/trace_gfs2.h SourceLine:511] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:trace_event_get_offsets_gfs2_iomap_start SourceFile:fs/gfs2/trace_gfs2.h SourceLine:481] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:trace_event_raw_event_gfs2_block_alloc SourceFile:fs/gfs2/trace_gfs2.h SourceLine:551] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:trace_event_raw_event_gfs2_bmap SourceFile:fs/gfs2/trace_gfs2.h SourceLine:442] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:trace_event_raw_event_gfs2_iomap_end SourceFile:fs/gfs2/trace_gfs2.h SourceLine:511] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:trace_event_raw_event_gfs2_iomap_start SourceFile:fs/gfs2/trace_gfs2.h SourceLine:481] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:trace_gfs2_block_alloc SourceFile:fs/gfs2/trace_gfs2.h SourceLine:551] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:trace_gfs2_bmap SourceFile:fs/gfs2/trace_gfs2.h SourceLine:442] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:trace_gfs2_iomap_end SourceFile:fs/gfs2/trace_gfs2.h SourceLine:511] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:trace_gfs2_iomap_start SourceFile:fs/gfs2/trace_gfs2.h SourceLine:481] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:trunc_end SourceFile:fs/gfs2/bmap.c SourceLine:1995] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:trunc_start SourceFile:fs/gfs2/bmap.c SourceLine:1374] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:try_rgrp_unlink SourceFile:fs/gfs2/rgrp.c SourceLine:1847] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:unregister_trace_gfs2_block_alloc SourceFile:fs/gfs2/trace_gfs2.h SourceLine:551] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:unregister_trace_gfs2_bmap SourceFile:fs/gfs2/trace_gfs2.h SourceLine:442] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:unregister_trace_gfs2_iomap_end SourceFile:fs/gfs2/trace_gfs2.h SourceLine:511] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:unregister_trace_gfs2_iomap_start SourceFile:fs/gfs2/trace_gfs2.h SourceLine:481] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:update_moved_ino SourceFile:fs/gfs2/inode.c SourceLine:1463] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:update_moved_ino SourceFile:fs/gfs2/inode.c SourceLine:1463] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:update_qd SourceFile:fs/gfs2/quota.c SourceLine:998] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:update_statfs SourceFile:fs/gfs2/super.c SourceLine:247] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:update_statfs SourceFile:fs/gfs2/super.c SourceLine:248] map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:update_statfs_inode SourceFile:fs/gfs2/recovery.c SourceLine:309] map[ReferenceKind:uses ReferencingEntityKind:typedef ReferencingEntityName:btf_trace_gfs2_block_alloc SourceFile:fs/gfs2/trace_gfs2.h SourceLine:551] map[ReferenceKind:uses ReferencingEntityKind:typedef ReferencingEntityName:btf_trace_gfs2_bmap SourceFile:fs/gfs2/trace_gfs2.h SourceLine:442] map[ReferenceKind:uses ReferencingEntityKind:typedef ReferencingEntityName:btf_trace_gfs2_iomap_end SourceFile:fs/gfs2/trace_gfs2.h SourceLine:511] map[ReferenceKind:uses ReferencingEntityKind:typedef ReferencingEntityName:btf_trace_gfs2_iomap_start SourceFile:fs/gfs2/trace_gfs2.h SourceLine:481] map[ReferenceKind:uses ReferencingEntityKind:typedef ReferencingEntityName:ea_call_t SourceFile:fs/gfs2/xattr.c SourceLine:84] map[ReferenceKind:uses ReferencingEntityKind:typedef ReferencingEntityName:ea_skeleton_call_t SourceFile:fs/gfs2/xattr.c SourceLine:738]] TruncatedOutput:false]
|
| 18/2 |
2026/05/24 08:17 |
llm |
expert |
0m
Model:
Tokens:
input: 37287
output: 45
thoughts: 25
Thoughts: Okay, here's my take on those thoughts, tailored for an expert audience:
**Diving into gfs2_alloc_inode**
Alright, let's get down to it. I'm focusing on `gfs2_alloc_inode` and where it lives in `fs/gfs2/super.c`. Right, so I need to re-familiarize myself with the intricacies of inode allocation within the GFS2 file system. What are the key aspects of the allocation strategy I need to consider here? I'm thinking about block group allocation, the on-disk structures, and how it all ties into the journal operations, specifically the locking involved in allocating an inode. I'm looking for potential bottlenecks, and how concurrent access is handled, I'm expecting some kind of bitmap or allocation structures to be updated for the new inode, and the details of how that impacts journaling. I will look at the super block data as well as the i-node itself, what data goes where and how is it related. What are the key data structures and how does the inode number get selected? I'm really curious about the potential interplay between this function and the overall GFS2 block allocator and how they relate. I'll need to re-examine the allocation code, ensuring that I haven't missed any opportunities for optimization within the framework of this code. Finally, I'll review any related error handling that is related to this task.
|
| 19/2 |
2026/05/24 08:18 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:fs/gfs2/super.c IncludeLines:true Name:gfs2_alloc_inode]
Results: map[SourceCode:1452: static struct inode *gfs2_alloc_inode(struct super_block *sb)
1453: {
1454: struct gfs2_inode *ip;
1455:
1456: ip = alloc_inode_sb(sb, gfs2_inode_cachep, GFP_KERNEL);
1457: if (!ip)
1458: return NULL;
1459: ip->i_no_addr = 0;
1460: ip->i_no_formal_ino = 0;
1461: ip->i_flags = 0;
1462: ip->i_gl = NULL;
1463: gfs2_holder_mark_uninitialized(&ip->i_iopen_gh);
1464: memset(&ip->i_res, 0, sizeof(ip->i_res));
1465: RB_CLEAR_NODE(&ip->i_res.rs_node);
1466: ip->i_diskflags = 0;
1467: ip->i_rahead = 0;
1468: return &ip->i_inode;
1469: }
SourceFile:fs/gfs2/super.c]
|
| 20/2 |
2026/05/24 08:18 |
llm |
expert |
0m
Model:
Tokens:
input: 38002
output: 47
thoughts: 28
Thoughts: Okay, here's my attempt at summarizing that thought process, keeping in mind I'm speaking to a fellow expert:
**Caching Inodes in GFS2**
Alright, let's break this down. My mind immediately flags `gfs2_inode_cachep`. That's *the* inode cache, right? The core of how GFS2 handles inode management, presumably for performance. My brain is latching onto the fact that it's constructed, and the specific constructor is `gfs2_init_inode_once`. Okay, so we're talking initialization here. `once` suggests this is likely a one-time setup, which makes sense. We're getting the essential elements prepped and ready for when they're actually needed for inode management.
|
| 21/2 |
2026/05/24 08:18 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:fs/gfs2/main.c IncludeLines:true Name:gfs2_init_inode_once]
Results: map[SourceCode: 34: static void gfs2_init_inode_once(void *foo)
35: {
36: struct gfs2_inode *ip = foo;
37:
38: inode_init_once(&ip->i_inode);
39: atomic_set(&ip->i_sizehint, 0);
40: init_rwsem(&ip->i_rw_mutex);
41: INIT_LIST_HEAD(&ip->i_ordered);
42: ip->i_qadata = NULL;
43: gfs2_holder_mark_uninitialized(&ip->i_rgd_gh);
44: memset(&ip->i_res, 0, sizeof(ip->i_res));
45: RB_CLEAR_NODE(&ip->i_res.rs_node);
46: ip->i_hash_cache = NULL;
47: gfs2_holder_mark_uninitialized(&ip->i_iopen_gh);
48: }
SourceFile:fs/gfs2/main.c]
|
| 22/2 |
2026/05/24 08:18 |
llm |
expert |
0m
Model:
Tokens:
input: 38538
output: 39
thoughts: 102
Thoughts: **Analyzing Inode Initialization and Reallocation**
Okay, so I'm focusing on the initialization of the read-write semaphore, `i_rwsem`, within inodes. My initial understanding is that `inode_init_once` handles this, specifically within the slab constructor. This makes sense; it's the point of the inode's creation.
The critical point then is whether the semaphore is re-initialized when an inode is freed and then subsequently reallocated. The implication is that if it's not reinitialized, any lingering stale semaphore state could cause serious concurrency issues. The code seems to suggest that `inode_init_once` is the primary initializor but there is a lingering doubt as to whether there is an `inode_init_always` call which would do this. Time to dig into `inode_init_always` within `fs/inode.c` to confirm or clarify my suspicions.
|
| 23/2 |
2026/05/24 08:18 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:fs/inode.c IncludeLines:true Name:inode_init_always]
Results: map[SourceCode:2920: static inline int inode_init_always(struct super_block *sb, struct inode *inode)
2921: {
2922: return inode_init_always_gfp(sb, inode, GFP_NOFS);
2923: }
SourceFile:include/linux/fs.h]
|
| 24/2 |
2026/05/24 08:18 |
llm |
expert |
0m
Model:
Tokens:
input: 38970
output: 42
thoughts: 22
Thoughts: Here's my take on those thoughts, tailored for an expert audience:
**Diving into Inode Initialization**
Alright, let's zero in on `inode_init_always_gfp` within `fs/inode.c`. I'm specifically curious about how this function handles the initialization of inodes, especially in relation to memory allocation flags (`GFP`). My experience has taught me that the allocation strategy at this stage has significant implications, so a close look is required.
|
| 25/2 |
2026/05/24 08:18 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:fs/inode.c IncludeLines:true Name:inode_init_always_gfp]
Results: map[SourceCode: 218: /**
219: * inode_init_always_gfp - perform inode structure initialisation
220: * @sb: superblock inode belongs to
221: * @inode: inode to initialise
222: * @gfp: allocation flags
223: *
224: * These are initializations that need to be done on every inode
225: * allocation as the fields are not initialised by slab allocation.
226: * If there are additional allocations required @gfp is used.
227: */
228: int inode_init_always_gfp(struct super_block *sb, struct inode *inode, gfp_t gfp)
229: {
230: static const struct inode_operations empty_iops;
231: static const struct file_operations no_open_fops = {.open = no_open};
232: struct address_space *const mapping = &inode->i_data;
233:
234: inode->i_sb = sb;
235: inode->i_blkbits = sb->s_blocksize_bits;
236: inode->i_flags = 0;
237: inode_state_assign_raw(inode, 0);
238: atomic64_set(&inode->i_sequence, 0);
239: atomic_set(&inode->i_count, 1);
240: inode->i_op = &empty_iops;
241: inode->i_fop = &no_open_fops;
242: inode->i_ino = 0;
243: inode->__i_nlink = 1;
244: inode->i_opflags = 0;
245: if (sb->s_xattr)
246: inode->i_opflags |= IOP_XATTR;
247: if (sb->s_type->fs_flags & FS_MGTIME)
248: inode->i_opflags |= IOP_MGTIME;
249: i_uid_write(inode, 0);
250: i_gid_write(inode, 0);
251: atomic_set(&inode->i_writecount, 0);
252: inode->i_size = 0;
253: inode->i_write_hint = WRITE_LIFE_NOT_SET;
254: inode->i_blocks = 0;
255: inode->i_bytes = 0;
256: inode->i_generation = 0;
257: inode->i_pipe = NULL;
258: inode->i_cdev = NULL;
259: inode->i_link = NULL;
260: inode->i_dir_seq = 0;
261: inode->i_rdev = 0;
262: inode->dirtied_when = 0;
263:
264: #ifdef CONFIG_CGROUP_WRITEBACK
265: inode->i_wb_frn_winner = 0;
266: inode->i_wb_frn_avg_time = 0;
267: inode->i_wb_frn_history = 0;
268: #endif
269:
270: spin_lock_init(&inode->i_lock);
271: lockdep_set_class(&inode->i_lock, &sb->s_type->i_lock_key);
272:
273: init_rwsem(&inode->i_rwsem);
274: lockdep_set_class(&inode->i_rwsem, &sb->s_type->i_mutex_key);
275:
276: atomic_set(&inode->i_dio_count, 0);
277:
278: mapping->a_ops = &empty_aops;
279: mapping->host = inode;
280: mapping->flags = 0;
281: mapping->wb_err = 0;
282: atomic_set(&mapping->i_mmap_writable, 0);
283: #ifdef CONFIG_READ_ONLY_THP_FOR_FS
284: atomic_set(&mapping->nr_thps, 0);
285: #endif
286: mapping_set_gfp_mask(mapping, GFP_HIGHUSER_MOVABLE);
287: mapping->i_private_data = NULL;
288: mapping->writeback_index = 0;
289: init_rwsem(&mapping->invalidate_lock);
290: lockdep_set_class_and_name(&mapping->invalidate_lock,
291: &sb->s_type->invalidate_lock_key,
292: "mapping.invalidate_lock");
293: if (sb->s_iflags & SB_I_STABLE_WRITES)
294: mapping_set_stable_writes(mapping);
295: inode->i_private = NULL;
296: inode->i_mapping = mapping;
297: INIT_HLIST_HEAD(&inode->i_dentry); /* buggered by rcu freeing */
298: #ifdef CONFIG_FS_POSIX_ACL
299: inode->i_acl = inode->i_default_acl = ACL_NOT_CACHED;
300: #endif
301:
302: #ifdef CONFIG_FSNOTIFY
303: inode->i_fsnotify_mask = 0;
304: #endif
305: inode->i_flctx = NULL;
306:
307: if (unlikely(security_inode_alloc(inode, gfp)))
308: return -ENOMEM;
309:
310: this_cpu_inc(nr_inodes);
311:
312: return 0;
313: }
SourceFile:fs/inode.c]
|
| 26/2 |
2026/05/24 08:18 |
llm |
expert |
0m
Model:
Tokens:
input: 40799
output: 45
thoughts: 699
Thoughts: **Debugging a Potential Race Condition in Inode Locking**
Okay, so I'm digging into this inode locking issue. It seems like the core of the problem lies with the re-initialization of `i_rwsem` within an inode. Specifically, `init_rwsem(&inode->i_rwsem)` is called in `inode_init_always_gfp`. The implications are clear: `i_rwsem` IS being reinitialized every time an inode is allocated.
Here's where it gets interesting and where the race condition likely comes in: if `i_rwsem` is reinitialized while a task is actively waiting on the lock, that waiter's `wait_list` is reset to empty. However, the waiter's own `list` pointer still references the original, now invalid, head of the `wait_list`. When the waiter eventually wakes up and tries to acquire (or release) the lock, it calls `list_del(&waiter->list)`. `list_del` does some sanity checks, like `prev->next == entry` and `next->prev == entry`. Since the `wait_list` has been reinitialized, the `prev->next` will point to the *new* `wait_list` which isn't the correct entry - and boom! Corruption is detected.
This perfectly explains the reported bug: an inode gets freed and reallocated while a task is waiting on its `i_rwsem`. But wait... how can an inode *be* freed while a task is waiting on it? Let's trace it through. The task in question is in `chown_common`, which calls `inode_lock_killable(inode)`. That in turn calls `down_write_killable(&inode->i_rwsem)`. If a task is blocked on `down_write_killable` then it should have a reference on the associated file and dentry, meaning the inode SHOULDN'T be freed! Is this a use-after-free, or some sort of inode eviction/reallocation?
If an inode is evicted, it's removed from the inode cache, but its memory is freed to the slab. Assuming we have a reference to the inode, this shouldn't be the case. So, how is it freed? Could the task *not* have a reference? Let's check `chown_common`.
Looking at the code:
```c
int chown_common(const struct path *path, uid_t user, gid_t group)
{
struct inode *inode = path->dentry->d_inode;
struct inode *delegated_inode = NULL;
int error;
retry_deleg:
mnt_want_write(path->mnt);
inode_lock_killable(inode);
...
```
The `path` argument comes from `do_fchownat`:
```c
error = user_path_at(dfd, filename, lookup_flags, &path);
if (error)
goto out;
error = mnt_want_write(path.mnt);
if (error)
goto out_release;
error = chown_common(&path, user, group);
```
So `path` holds a reference to the dentry, which *should* hold a reference to the inode. Therefore, the inode *shouldn't* be freed. It's almost certain at this stage that the refcounting semantics are being violated somewhere.
Could the `gfs2` filesystem be freeing inode memory without respecting the VFS refcount, or, more likely, reusing the inode memory? I'll need to check `gfs2_alloc_inode` and `gfs2_free_inode` to understand their allocation/deallocation strategies. It seems like the `gfs2` filesystem is the only suspect at this point.
|
| 27/2 |
2026/05/24 08:18 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:fs/gfs2/super.c IncludeLines:true Name:gfs2_free_inode]
Results: map[SourceCode:1471: static void gfs2_free_inode(struct inode *inode)
1472: {
1473: kmem_cache_free(gfs2_inode_cachep, GFS2_I(inode));
1474: }
SourceFile:fs/gfs2/super.c]
|
| 28/2 |
2026/05/24 08:18 |
llm |
expert |
0m
Model:
Tokens:
input: 42484
output: 46
thoughts: 83
Thoughts: **Debugging a Potential Kernel Vulnerability**
Okay, so I'm looking at this bug triggered by syzkaller. My initial thought is that it might be a classic use-after-free issue with either the `struct file` or `struct dentry`. But since syzkaller is involved, that narrows things down a bit, and I need to consider common patterns that syzkaller exploits.
Let's pause and see if there's a known problem specifically relating to `gfs2` and the `chown` system call. Perhaps there's an existing bug report or patch I can leverage.
If that doesn't yield anything immediately useful, I should investigate `gfs2_evict_inode` as the next likely culprit. A bug in that function could easily lead to the kind of crash syzkaller is flagging. I'll focus my efforts on understanding the execution path and what resources it manages. Let's see what's happening within that function.
|
| 29/2 |
2026/05/24 08:18 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:fs/gfs2/super.c IncludeLines:true Name:gfs2_evict_inode]
Results: map[SourceCode:1381: static void gfs2_evict_inode(struct inode *inode)
1382: {
1383: struct super_block *sb = inode->i_sb;
1384: struct gfs2_sbd *sdp = sb->s_fs_info;
1385: struct gfs2_inode *ip = GFS2_I(inode);
1386: struct gfs2_holder gh;
1387: enum evict_behavior behavior;
1388: int ret;
1389:
1390: gfs2_holder_mark_uninitialized(&gh);
1391: if (inode->i_nlink || sb_rdonly(sb) || !ip->i_no_addr)
1392: goto out;
1393:
1394: /*
1395: * In case of an incomplete mount, gfs2_evict_inode() may be called for
1396: * system files without having an active journal to write to. In that
1397: * case, skip the filesystem evict.
1398: */
1399: if (!sdp->sd_jdesc)
1400: goto out;
1401:
1402: behavior = evict_should_delete(inode, &gh);
1403: if (behavior == EVICT_SHOULD_DEFER_DELETE &&
1404: !test_bit(SDF_KILL, &sdp->sd_flags)) {
1405: struct gfs2_glock *io_gl = ip->i_iopen_gh.gh_gl;
1406:
1407: if (io_gl) {
1408: gfs2_glock_hold(io_gl);
1409: if (!gfs2_queue_verify_delete(io_gl, true))
1410: gfs2_glock_put(io_gl);
1411: goto out;
1412: }
1413: behavior = EVICT_SHOULD_SKIP_DELETE;
1414: }
1415: if (behavior == EVICT_SHOULD_DELETE)
1416: ret = evict_unlinked_inode(inode);
1417: else
1418: ret = evict_linked_inode(inode);
1419:
1420: if (gfs2_rs_active(&ip->i_res))
1421: gfs2_rs_deltree(&ip->i_res);
1422:
1423: if (ret && ret != GLR_TRYFAILED && ret != -EROFS)
1424: fs_warn(sdp, "gfs2_evict_inode: %d\n", ret);
1425: out:
1426: if (gfs2_holder_initialized(&gh))
1427: gfs2_glock_dq_uninit(&gh);
1428: truncate_inode_pages_final(&inode->i_data);
1429: if (ip->i_qadata)
1430: gfs2_assert_warn(sdp, ip->i_qadata->qa_ref == 0);
1431: gfs2_rs_deltree(&ip->i_res);
1432: gfs2_ordered_del_inode(ip);
1433: clear_inode(inode);
1434: gfs2_dir_hash_inval(ip);
1435: if (gfs2_holder_initialized(&ip->i_iopen_gh)) {
1436: struct gfs2_glock *gl = ip->i_iopen_gh.gh_gl;
1437:
1438: glock_clear_object(gl, ip);
1439: gfs2_glock_hold(gl);
1440: ip->i_iopen_gh.gh_flags |= GL_NOCACHE;
1441: gfs2_glock_dq_uninit(&ip->i_iopen_gh);
1442: gfs2_glock_put_eventually(gl);
1443: }
1444: if (ip->i_gl) {
1445: glock_clear_object(ip->i_gl, ip);
1446: wait_on_bit_io(&ip->i_flags, GIF_GLOP_PENDING, TASK_UNINTERRUPTIBLE);
1447: gfs2_glock_put_eventually(ip->i_gl);
1448: rcu_assign_pointer(ip->i_gl, NULL);
1449: }
1450: }
SourceFile:fs/gfs2/super.c]
|
| 30/2 |
2026/05/24 08:18 |
llm |
expert |
0m
Model:
Tokens:
input: 44113
output: 45
thoughts: 760
Thoughts: **Debugging a Suspected Inode Reference Count Issue in GFS2**
Okay, so I'm diving into this crash, and it seems to be happening within `rwsem_try_write_lock`, specifically during the list manipulation. My initial thought was that there's a problem related to inode reference counts and eviction, specifically around how `gfs2_evict_inode` and `clear_inode` interact. If an inode gets evicted, that implies its reference count is zero. But, the code indicates `chown_common` holds a reference through the dentry, which should prevent the count from dropping to zero, so I'm not immediately buying that.
Then, I started wondering if a signal could interrupt the process and cause problems, I considered if the task was killed in `inode_lock_killable` and that returned `-EINTR`. This seemed plausible at first because the dentry reference would be dropped. This then led to some thoughts about a race. However, the problem occurs in `rwsem_try_write_lock`, within the loop of `rwsem_down_write_slowpath`. I honed in on the fact that if a signal is pending, it exits to `out_nolock`, which removes a waiter from the wait queue. However, the problem is in `rwsem_try_write_lock` itself, where a successful acquisition involves removing the waiter.
So, the issue is that the list seems corrupted when the task is *successfully* acquiring the lock and trying to remove itself. That's a classic sign of another task stepping on the same data. My brain is trying to figure out how this could happen, and the first place my thought went was inode reuse. Could another task reinitialize the `rwsem` while this one is waiting on it? That would mean the inode was freed and reallocated! But the current task has a reference to the inode through the dentry, so shouldn't that be impossible? I need to rule this out, and also consider the possibility of a "bad inode."
The dentry's inode pointer is not being changed by `mnt_want_write` or `chown_common`, so it seems this can't be explained by a straightforward pointer change. Is there a GFS2 bug, maybe, where an inode is freed prematurely? I quickly checked if GFS2 could be reusing the `i_rwsem` for something else, but that doesn't seem to be the case. I need to focus on if it's freeing the inode without verifying the refcount. I'll need to check `gfs2_drop_inode` in that case, to see what could be going on.
|
| 31/2 |
2026/05/24 08:18 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:fs/gfs2/super.c IncludeLines:true Name:gfs2_drop_inode]
Results: map[SourceCode:1005: static int gfs2_drop_inode(struct inode *inode)
1006: {
1007: struct gfs2_inode *ip = GFS2_I(inode);
1008: struct gfs2_sbd *sdp = GFS2_SB(inode);
1009:
1010: if (inode->i_nlink &&
1011: gfs2_holder_initialized(&ip->i_iopen_gh)) {
1012: struct gfs2_glock *gl = ip->i_iopen_gh.gh_gl;
1013: if (glock_needs_demote(gl))
1014: clear_nlink(inode);
1015: }
1016:
1017: /*
1018: * When under memory pressure when an inode's link count has dropped to
1019: * zero, defer deleting the inode to the delete workqueue. This avoids
1020: * calling into DLM under memory pressure, which can deadlock.
1021: */
1022: if (!inode->i_nlink &&
1023: unlikely(current->flags & PF_MEMALLOC) &&
1024: gfs2_holder_initialized(&ip->i_iopen_gh)) {
1025: struct gfs2_glock *gl = ip->i_iopen_gh.gh_gl;
1026:
1027: gfs2_glock_hold(gl);
1028: if (!gfs2_queue_verify_delete(gl, true))
1029: gfs2_glock_put_async(gl);
1030: return 0;
1031: }
1032:
1033: /*
1034: * No longer cache inodes when trying to evict them all.
1035: */
1036: if (test_bit(SDF_EVICTING, &sdp->sd_flags))
1037: return 1;
1038:
1039: return inode_generic_drop(inode);
1040: }
SourceFile:fs/gfs2/super.c]
|
| 32/2 |
2026/05/24 08:18 |
llm |
expert |
0m
Model:
Tokens:
input: 46098
output: 44
thoughts: 1579
Thoughts: **Deep Dive into a Complex Inode Race Condition**
Okay, so I'm staring at this crash and my mind is racing. The core issue seems to revolve around a race condition during `chown_common`, specifically when it's interacting with the `gfs2_inode`. First, I need to understand the basic reference counting and eviction flow to be sure it makes sense, but it *should* be fine.
I immediately consider the possibility that a call to `gfs2_drop_inode` could be returning 1 due to the `SDF_EVICTING` flag, leading to an early eviction, but it can't be - that would be prevented by the reference held by `chown_common`. It's called on the *last* reference drop, so `chown_common`'s access should prevent that. But I do need to double-check that `chown_common` actually *has* a reference. It gets the inode through `user_path_at`, which should hold a reference to the dentry, and the dentry, in turn, holds a reference to the inode. So, the inode count is *at least* one, as expected.
I have to rule out a NULL `d_inode`, which would crash with a NULL pointer dereference. But, it crashes in `rwsem_try_write_lock`, so that's not it. Then I wonder if this `gfs2_inode` is a SLAB object that has been corrupted somehow. Maybe it was freed and reallocated? Or, is it possible this is operating on a *closed* file descriptor, but I checked the use of `user_path_at` and `do_fchownat`, so the reference should be held.
Now, let's go back and examine the crash data. I see the "list_del corruption." The `prev` pointer is the `wait_list`, but `waiter` is still pointing to the `wait_list` head when it's supposed to be removed. So the `wait_list` became empty while the `waiter` on the stack still thinks it's there. The problem must be that `sem->wait_list` is empty!
I realize that it has to be *reinitialized*. The crash looks like `init_rwsem` was called, and that can empty the `wait_list`. If `init_rwsem` gets called on an *active* `rwsem`, the waiters are still on the stack, but the list is reset. Then, during the `list_del`, it will crash!
Wait, `init_rwsem` is indeed called on every inode allocation in `inode_init_always`. This means the inode could be freed and reallocated while `chown_common` is waiting. But how can that happen if a reference is held?
Could `chown_common` be waiting on *another* inode's `i_rwsem`? No, the code is getting the correct inode via the `path` struct and locking it. Could `path->dentry->d_inode` point to a *freed* inode, since the dentry *should* hold a reference? It should *not* be a bad inode - that would prevent the free. Unless the filesystem was unmounted? The mount is still valid, since the `vfsmount` is still referenced.
It must be a use-after-free, somehow. Is `gfs2` prematurely freeing the inode somewhere? I need to check `gfs2_create_inode` and `gfs2_lookup` to make sure nothing is going wrong there.
|
| 33/2 |
2026/05/24 08:19 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:fs/gfs2/inode.c IncludeLines:true Name:gfs2_lookupi]
Results: map[SourceCode: 322: struct inode *gfs2_lookupi(struct inode *dir, const struct qstr *name,
323: int is_root)
324: {
325: struct super_block *sb = dir->i_sb;
326: struct gfs2_inode *dip = GFS2_I(dir);
327: struct gfs2_holder d_gh;
328: int error = 0;
329: struct inode *inode = NULL;
330:
331: gfs2_holder_mark_uninitialized(&d_gh);
332: if (!name->len || name->len > GFS2_FNAMESIZE)
333: return ERR_PTR(-ENAMETOOLONG);
334:
335: if ((name->len == 1 && memcmp(name->name, ".", 1) == 0) ||
336: (name->len == 2 && memcmp(name->name, "..", 2) == 0 &&
337: dir == d_inode(sb->s_root))) {
338: igrab(dir);
339: return dir;
340: }
341:
342: if (gfs2_glock_is_locked_by_me(dip->i_gl) == NULL) {
343: error = gfs2_glock_nq_init(dip->i_gl, LM_ST_SHARED, 0, &d_gh);
344: if (error)
345: return ERR_PTR(error);
346: }
347:
348: if (!is_root) {
349: error = gfs2_permission(&nop_mnt_idmap, dir, MAY_EXEC);
350: if (error)
351: goto out;
352: }
353:
354: inode = gfs2_dir_search(dir, name, false);
355: if (IS_ERR(inode))
356: error = PTR_ERR(inode);
357: out:
358: if (gfs2_holder_initialized(&d_gh))
359: gfs2_glock_dq_uninit(&d_gh);
360: if (error == -ENOENT)
361: return NULL;
362: return inode ? inode : ERR_PTR(error);
363: }
SourceFile:fs/gfs2/inode.c]
|
| 34/2 |
2026/05/24 08:19 |
llm |
expert |
0m
Model:
Tokens:
input: 49221
output: 30
thoughts: 479
Thoughts: **Debugging a Potential GFS2 Inode Free/Use-After-Free**
Okay, so I'm chasing a potential race condition or use-after-free in the GFS2 filesystem. The core of my concern is around how inodes are created, freed, and potentially accessed. I'm thinking, `gfs2_create_inode` is responsible for inode allocation, and if something goes wrong during that process, it might free the inode. But if that happens, how can `chown_common` *possibly* access it later? That just doesn't make sense.
My first thought was, maybe `chown_common` is working with a file descriptor? Perhaps a `do_fchownat` with `AT_EMPTY_PATH`? If so, `user_path_at` would resolve the empty path to the associated file descriptor. If the file was opened, and then *unlinked*, the inode *should* still be alive because the file descriptor holds a reference. But that feels like a long shot.
The more likely scenario would be a bug within `gfs2`. Could GFS2 somehow prematurely evict an inode even if there are active references? I need to re-examine `gfs2_evict_inode`. Ah, right, VFS calls it when `i_count` reaches zero. VFS *guarantees* that `i_count` is zero before calling `evict_inode`. This means no one *should* be in `chown_common` holding a reference when the inode is being evicted, because the count should be zero.
Wait, could the process in `chown_common` be waiting on the `i_rwsem` of *another* object? No, because in `chown_common`, it's explicitly calling `inode_lock_killable(inode)` which then calls `down_write_killable(&inode->i_rwsem)`. So, it *is* the inode's semaphore.
Could `inode` be a dangling pointer? Could `dentry->d_inode` point to a freed memory location? When *is* `dentry->d_inode` set? `d_instantiate`. And when is it cleared? `d_delete` or `dentry_unlink_inode`. If a dentry is still alive and has a reference to the inode, the inode shouldn't be freed.
I'm starting to think `gfs2` might be directly freeing inode memory without going through the VFS. I need to search the GFS2 code for `kmem_cache_free`. This is looking like the most promising angle right now. Let's see what turns up.
|
| 35/2 |
2026/05/24 08:19 |
tool |
codesearch-find-references |
0m
Args: map[IncludeSnippetLines:0 Name:kmem_cache_free]
Results: map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__active_retire SourceFile:drivers/gpu/drm/i915/i915_active.c SourceLine:172] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__add_ino_entry SourceFile:fs/f2fs/checkpoint.c SourceLine:757] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__alloc_skb SourceFile:net/core/skbuff.c SourceLine:741] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__blockdev_direct_IO SourceFile:fs/direct-io.c SourceLine:1313] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__btrfs_add_free_space SourceFile:fs/btrfs/free-space-cache.c SourceLine:2669] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__btrfs_end_transaction SourceFile:fs/btrfs/transaction.c SourceLine:1113] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__btrfs_release_delayed_node SourceFile:fs/btrfs/delayed-inode.c SourceLine:310] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__btrfs_remove_free_space_cache SourceFile:fs/btrfs/free-space-cache.c SourceLine:74] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__ceph_unreserve_caps SourceFile:fs/ceph/caps.c SourceLine:185] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__cleanup_sighand SourceFile:kernel/fork.c SourceLine:1677] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__complete_revoke_list SourceFile:fs/f2fs/segment.c SourceLine:301] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__core_scsi3_alloc_registration SourceFile:drivers/target/target_core_pr.c SourceLine:816] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__core_scsi3_alloc_registration SourceFile:drivers/target/target_core_pr.c SourceLine:818] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__core_scsi3_do_alloc_registration SourceFile:drivers/target/target_core_pr.c SourceLine:659] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__core_scsi3_free_registration SourceFile:drivers/target/target_core_pr.c SourceLine:1333] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__d_alloc SourceFile:fs/dcache.c SourceLine:1761] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__d_alloc SourceFile:fs/dcache.c SourceLine:1798] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__d_free SourceFile:fs/dcache.c SourceLine:346] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__d_free_external SourceFile:fs/dcache.c SourceLine:353] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__destroy_extent_tree SourceFile:fs/f2fs/extent_cache.c SourceLine:1196] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__detach_discard_cmd SourceFile:fs/f2fs/segment.c SourceLine:1113] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__detach_extent_node SourceFile:fs/f2fs/extent_cache.c SourceLine:324] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__es_free_extent SourceFile:fs/ext4/extents_status.c SourceLine:564] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__f2fs_commit_atomic_write SourceFile:fs/f2fs/segment.c SourceLine:359] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__flush_nat_entry_set SourceFile:fs/f2fs/node.c SourceLine:3167] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__free_client SourceFile:fs/nfsd/nfs4state.c SourceLine:2412] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__free_lkb_rcu SourceFile:fs/dlm/memory.c SourceLine:131] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__free_nat_entry SourceFile:fs/f2fs/node.c SourceLine:188] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__free_pending SourceFile:fs/ext4/extents_status.c SourceLine:519] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__free_rsb_rcu SourceFile:fs/dlm/memory.c SourceLine:105] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__i915_priolist_free SourceFile:drivers/gpu/drm/i915/i915_scheduler.c SourceLine:121] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__i915_request_create SourceFile:drivers/gpu/drm/i915/i915_request.c SourceLine:1023] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__inet_bhash2_update_saddr SourceFile:net/ipv4/inet_hashtables.c SourceLine:1004] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__io_req_caches_free SourceFile:io_uring/io_uring.c SourceLine:2134] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__kernfs_new_node SourceFile:fs/kernfs/dir.c SourceLine:686] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__kernfs_new_node SourceFile:fs/kernfs/dir.c SourceLine:693] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__ksmbd_close_fd SourceFile:fs/smb/server/vfs_cache.c SourceLine:477] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__load_free_space_cache SourceFile:fs/btrfs/free-space-cache.c SourceLine:822] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__load_free_space_cache SourceFile:fs/btrfs/free-space-cache.c SourceLine:828] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__load_free_space_cache SourceFile:fs/btrfs/free-space-cache.c SourceLine:839] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__load_free_space_cache SourceFile:fs/btrfs/free-space-cache.c SourceLine:849] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__load_free_space_cache SourceFile:fs/btrfs/free-space-cache.c SourceLine:859] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__load_free_space_cache SourceFile:fs/btrfs/free-space-cache.c SourceLine:860] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__mb_cache_entry_free SourceFile:fs/mbcache.c SourceLine:135] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__merge_or_add_vmap_area SourceFile:mm/vmalloc.c SourceLine:1479] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__merge_or_add_vmap_area SourceFile:mm/vmalloc.c SourceLine:1510] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__mmdrop SourceFile:kernel/fork.c SourceLine:737] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__node_free_rcu SourceFile:net/ipv4/fib_trie.c SourceLine:308] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__ocfs2_set_buffer_uptodate SourceFile:fs/ocfs2/uptodate.c SourceLine:437] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__ocfs2_set_buffer_uptodate SourceFile:fs/ocfs2/uptodate.c SourceLine:444] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__radix_tree_preload SourceFile:lib/radix-tree.c SourceLine:348] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__rds_conn_create SourceFile:net/rds/connection.c SourceLine:202] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__rds_conn_create SourceFile:net/rds/connection.c SourceLine:231] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__rds_conn_create SourceFile:net/rds/connection.c SourceLine:259] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__rds_conn_create SourceFile:net/rds/connection.c SourceLine:287] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__rds_conn_create SourceFile:net/rds/connection.c SourceLine:310] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__rds_conn_create SourceFile:net/rds/connection.c SourceLine:337] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__remove_ino_entry SourceFile:fs/f2fs/checkpoint.c SourceLine:772] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__reqsk_free SourceFile:net/ipv4/inet_connection_sock.c SourceLine:914] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__shrink_extent_tree SourceFile:fs/f2fs/extent_cache.c SourceLine:997] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__sigqueue_free SourceFile:kernel/signal.c SourceLine:475] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__skb_ext_put SourceFile:net/core/skbuff.c SourceLine:7252] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__ssam_event_item_free_cached SourceFile:drivers/platform/surface/aggregator/controller.c SourceLine:584] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__tree_nodes_free SourceFile:net/netfilter/nf_conncount.c SourceLine:367] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__verity_fec_finish_io SourceFile:drivers/md/dm-verity-fec.c SourceLine:462] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:_gb_operation_destroy SourceFile:drivers/greybus/operation.c SourceLine:682] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:acpi_os_release_object SourceFile:drivers/acpi/osl.c SourceLine:1644] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:add SourceFile:drivers/net/wireguard/allowedips.c SourceLine:237] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:add_delayed_ref SourceFile:fs/btrfs/delayed-ref.c SourceLine:1091] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:add_delayed_ref SourceFile:fs/btrfs/delayed-ref.c SourceLine:1102] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:add_delayed_ref SourceFile:fs/btrfs/delayed-ref.c SourceLine:1104] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:add_delayed_ref_head SourceFile:fs/btrfs/delayed-ref.c SourceLine:876] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:add_free_nid SourceFile:fs/f2fs/node.c SourceLine:2468] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:add_system_zone SourceFile:fs/ext4/block_validity.c SourceLine:108] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:add_system_zone SourceFile:fs/ext4/block_validity.c SourceLine:119] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:adfs_free_inode SourceFile:fs/adfs/super.c SourceLine:206] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:affs_free_inode SourceFile:fs/affs/super.c SourceLine:117] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:afs_free_inode SourceFile:fs/afs/super.c SourceLine:703] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:aio_get_req SourceFile:fs/aio.c SourceLine:1062] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:alloc_and_link_pwqs SourceFile:kernel/workqueue.c SourceLine:5627] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:alloc_buffer SourceFile:drivers/md/dm-bufio.c SourceLine:1243] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:alloc_cache_entry SourceFile:fs/smb/client/dfs_cache.c SourceLine:439] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:alloc_client SourceFile:fs/nfsd/nfs4state.c SourceLine:2395] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:alloc_empty_backing_file SourceFile:fs/file_table.c SourceLine:304] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:alloc_empty_file SourceFile:fs/file_table.c SourceLine:243] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:alloc_empty_file_noaccount SourceFile:fs/file_table.c SourceLine:277] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:alloc_ordered_extent SourceFile:fs/btrfs/ordered-data.c SourceLine:189] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:alloc_pid SourceFile:kernel/pid.c SourceLine:350] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:alloc_posix_timer SourceFile:kernel/time/posix-timers.c SourceLine:427] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:alloc_stateowner SourceFile:fs/nfsd/nfs4state.c SourceLine:4969] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:alloc_uid SourceFile:kernel/user.c SourceLine:216] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:alloc_uid SourceFile:kernel/user.c SourceLine:230] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:alloc_vfsmnt SourceFile:fs/namespace.c SourceLine:336] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:alloc_vmap_area SourceFile:mm/vmalloc.c SourceLine:2157] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:anon_vma_chain_free SourceFile:mm/rmap.c SourceLine:147] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:anon_vma_free SourceFile:mm/rmap.c SourceLine:137] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:audit_buffer_free SourceFile:kernel/audit.c SourceLine:1825] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:audit_tree_destroy_watch SourceFile:kernel/audit_tree.c SourceLine:175] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:backing_aio_put SourceFile:fs/backing-file.c SourceLine:102] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:batadv_tt_changes_list_free SourceFile:net/batman-adv/translation-table.c SourceLine:1381] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:batadv_tt_local_add SourceFile:net/batman-adv/translation-table.c SourceLine:669] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:batadv_tt_local_event SourceFile:net/batman-adv/translation-table.c SourceLine:459] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:batadv_tt_local_event SourceFile:net/batman-adv/translation-table.c SourceLine:469] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:batadv_tt_req_node_release SourceFile:net/batman-adv/translation-table.c SourceLine:2526] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:batadv_tt_roam_list_free SourceFile:net/batman-adv/translation-table.c SourceLine:3376] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:batadv_tt_roam_purge SourceFile:net/batman-adv/translation-table.c SourceLine:3393] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:batadv_tt_tvlv_container_update SourceFile:net/batman-adv/translation-table.c SourceLine:987] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:bdev_alloc_inode SourceFile:block/bdev.c SourceLine:387] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:bdev_free_inode SourceFile:block/bdev.c SourceLine:410] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:befs_free_inode SourceFile:fs/befs/linuxvfs.c SourceLine:289] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:bfq_put_queue SourceFile:block/bfq-iosched.c SourceLine:5407] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:bfs_free_inode SourceFile:fs/bfs/inode.c SourceLine:265] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:blk_alloc_queue SourceFile:block/blk-core.c SourceLine:475] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:blk_free_queue_rcu SourceFile:block/blk-core.c SourceLine:254] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:btracker_complete SourceFile:drivers/md/dm-cache-background-tracker.c SourceLine:228] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:btracker_destroy SourceFile:drivers/md/dm-cache-background-tracker.c SourceLine:57] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:btracker_queue SourceFile:drivers/md/dm-cache-background-tracker.c SourceLine:187] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:btrfs_add_delayed_extent_op SourceFile:fs/btrfs/delayed-ref.c SourceLine:1159] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:btrfs_add_delayed_extent_op SourceFile:fs/btrfs/delayed-ref.c SourceLine:1169] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:btrfs_add_inode_defrag SourceFile:fs/btrfs/defrag.c SourceLine:149] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:btrfs_add_inode_defrag SourceFile:fs/btrfs/defrag.c SourceLine:151] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:btrfs_alloc_from_cluster SourceFile:fs/btrfs/free-space-cache.c SourceLine:3307] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:btrfs_alloc_from_cluster SourceFile:fs/btrfs/free-space-cache.c SourceLine:3314] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:btrfs_cleanup_defrag_inodes SourceFile:fs/btrfs/defrag.c SourceLine:206] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:btrfs_commit_transaction SourceFile:fs/btrfs/transaction.c SourceLine:2627] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:btrfs_find_space_for_alloc SourceFile:fs/btrfs/free-space-cache.c SourceLine:3134] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:btrfs_free_delayed_extent_op SourceFile:fs/btrfs/delayed-ref.h SourceLine:356] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:btrfs_free_extent_map SourceFile:fs/btrfs/extent_map.c SourceLine:68] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:btrfs_free_extent_state SourceFile:fs/btrfs/extent-io-tree.c SourceLine:182] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:btrfs_free_inode SourceFile:fs/btrfs/inode.c SourceLine:8127] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:btrfs_free_path SourceFile:fs/btrfs/ctree.c SourceLine:151] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:btrfs_get_or_create_delayed_node SourceFile:fs/btrfs/delayed-inode.c SourceLine:184] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:btrfs_put_delayed_ref SourceFile:fs/btrfs/delayed-ref.c SourceLine:1186] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:btrfs_put_delayed_ref_head SourceFile:fs/btrfs/delayed-ref.h SourceLine:374] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:btrfs_put_ordered_extent SourceFile:fs/btrfs/ordered-data.c SourceLine:633] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:btrfs_release_extent_buffer SourceFile:fs/btrfs/extent_io.c SourceLine:3011] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:btrfs_release_extent_buffer_rcu SourceFile:fs/btrfs/extent_io.c SourceLine:3616] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:btrfs_remove_free_space SourceFile:fs/btrfs/free-space-cache.c SourceLine:2863] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:btrfs_run_defrag_inode SourceFile:fs/btrfs/defrag.c SourceLine:270] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:bvec_free SourceFile:block/bio.c SourceLine:169] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:cache_free_handle SourceFile:mm/zsmalloc.c SourceLine:384] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:cache_free_zspage SourceFile:mm/zsmalloc.c SourceLine:396] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:cachefiles_alloc_object SourceFile:fs/cachefiles/interface.c SourceLine:36] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:cachefiles_put_object SourceFile:fs/cachefiles/interface.c SourceLine:101] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:can_rx_delete_receiver SourceFile:net/can/af_can.c SourceLine:496] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ceph_caps_finalize SourceFile:fs/ceph/caps.c SourceLine:146] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ceph_d_release SourceFile:fs/ceph/dir.c SourceLine:2097] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ceph_free_cap_flush SourceFile:fs/ceph/caps.c SourceLine:1855] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ceph_free_inode SourceFile:fs/ceph/inode.c SourceLine:730] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ceph_init_file_info SourceFile:fs/ceph/file.c SourceLine:253] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ceph_mdsc_release_request SourceFile:fs/ceph/mds_client.c SourceLine:1137] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ceph_msg_free SourceFile:net/ceph/messenger.c SourceLine:2157] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ceph_osdc_release_request SourceFile:net/ceph/osd_client.c SourceLine:507] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ceph_put_cap SourceFile:fs/ceph/caps.c SourceLine:404] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ceph_put_cap_snap SourceFile:fs/ceph/super.h SourceLine:282] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ceph_release SourceFile:fs/ceph/file.c SourceLine:1008] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ceph_release SourceFile:fs/ceph/file.c SourceLine:1018] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:cgw_create_job SourceFile:net/can/gw.c SourceLine:1188] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:cgw_job_free_rcu SourceFile:net/can/gw.c SourceLine:597] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:cifs_free_inode SourceFile:fs/smb/client/cifsfs.c SourceLine:498] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:cleanup_transaction SourceFile:fs/btrfs/transaction.c SourceLine:2130] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:clone_uts_ns SourceFile:kernel/utsname.c SourceLine:66] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:close_pdeo SourceFile:fs/proc/inode.c SourceLine:251] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:configfs_new_dirent SourceFile:fs/configfs/dir.c SourceLine:205] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:conn_free SourceFile:net/netfilter/nf_conncount.c SourceLine:94] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:copy_free_space_cache SourceFile:fs/btrfs/free-space-cache.c SourceLine:914] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:core_alua_free_lba_map SourceFile:drivers/target/target_core_alua.c SourceLine:1325] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:core_alua_free_lba_map SourceFile:drivers/target/target_core_alua.c SourceLine:1329] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:core_alua_free_lu_gp SourceFile:drivers/target/target_core_alua.c SourceLine:1515] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:core_alua_free_lu_gp_mem SourceFile:drivers/target/target_core_alua.c SourceLine:1544] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:core_alua_free_tg_pt_gp SourceFile:drivers/target/target_core_alua.c SourceLine:1766] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:core_alua_set_lu_gp_id SourceFile:drivers/target/target_core_alua.c SourceLine:1410] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:core_scsi3_decode_spec_i_port SourceFile:drivers/target/target_core_pr.c SourceLine:1515] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:core_scsi3_decode_spec_i_port SourceFile:drivers/target/target_core_pr.c SourceLine:1841] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:core_scsi3_decode_spec_i_port SourceFile:drivers/target/target_core_pr.c SourceLine:1844] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:core_scsi3_free_all_registrations SourceFile:drivers/target/target_core_pr.c SourceLine:1407] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:core_scsi3_release_preempt_and_abort SourceFile:drivers/target/target_core_pr.c SourceLine:2807] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:core_scsi3_ua_allocate SourceFile:drivers/target/target_core_ua.c SourceLine:99] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:core_scsi3_ua_clear_for_request_sense SourceFile:drivers/target/target_core_ua.c SourceLine:312] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:core_scsi3_ua_for_check_condition SourceFile:drivers/target/target_core_ua.c SourceLine:250] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:core_scsi3_ua_release_all SourceFile:drivers/target/target_core_ua.c SourceLine:183] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:create_cache SourceFile:mm/slab_common.c SourceLine:261] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:create_new_namespaces SourceFile:kernel/nsproxy.c SourceLine:159] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:create_pid_namespace SourceFile:kernel/pid_namespace.c SourceLine:133] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:create_user_ns SourceFile:kernel/user_namespace.c SourceLine:170] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:damon_free_region SourceFile:mm/damon/core.c SourceLine:151] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:dax_free_inode SourceFile:drivers/dax/super.c SourceLine:376] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:debug_objects_replace_static_objects SourceFile:lib/debugobjects.c SourceLine:1481] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:debugfs_free_inode SourceFile:fs/debugfs/inode.c SourceLine:235] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:del_bio_entry SourceFile:fs/f2fs/data.c SourceLine:833] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:del_fsync_inode SourceFile:fs/f2fs/recovery.c SourceLine:114] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:delayacct_tsk_free SourceFile:include/linux/delayacct.h SourceLine:125] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:delayed_free_pidns SourceFile:kernel/pid_namespace.c SourceLine:147] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:destroy_tree SourceFile:net/netfilter/nf_conncount.c SourceLine:671] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:dio_complete SourceFile:fs/direct-io.c SourceLine:317] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:dlm_free_cb SourceFile:fs/dlm/memory.c SourceLine:176] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:dlm_free_mhandle SourceFile:fs/dlm/memory.c SourceLine:146] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:dlm_free_msg SourceFile:fs/dlm/memory.c SourceLine:166] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:dlm_free_writequeue SourceFile:fs/dlm/memory.c SourceLine:156] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:dlm_get_lock_resource SourceFile:fs/ocfs2/dlm/dlmmaster.c SourceLine:993] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:dlm_lock_release SourceFile:fs/ocfs2/dlm/dlmlock.c SourceLine:352] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:dlm_lockres_release SourceFile:fs/ocfs2/dlm/dlmmaster.c SourceLine:513] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:dlm_lockres_release SourceFile:fs/ocfs2/dlm/dlmmaster.c SourceLine:515] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:dlm_master_request_handler SourceFile:fs/ocfs2/dlm/dlmmaster.c SourceLine:1459] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:dlm_master_request_handler SourceFile:fs/ocfs2/dlm/dlmmaster.c SourceLine:1468] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:dlm_master_request_handler SourceFile:fs/ocfs2/dlm/dlmmaster.c SourceLine:1482] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:dlm_master_request_handler SourceFile:fs/ocfs2/dlm/dlmmaster.c SourceLine:1542] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:dlm_migrate_lockres SourceFile:fs/ocfs2/dlm/dlmmaster.c SourceLine:2617] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:dlm_migrate_request_handler SourceFile:fs/ocfs2/dlm/dlmmaster.c SourceLine:3126] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:dlm_migrate_request_handler SourceFile:fs/ocfs2/dlm/dlmmaster.c SourceLine:3142] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:dlm_mle_release SourceFile:fs/ocfs2/dlm/dlmmaster.c SourceLine:427] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:dlm_new_lock SourceFile:fs/ocfs2/dlm/dlmlock.c SourceLine:419] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:dlm_new_lockres SourceFile:fs/ocfs2/dlm/dlmmaster.c SourceLine:597] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:dlmfs_free_inode SourceFile:fs/ocfs2/dlmfs/dlmfs.c SourceLine:292] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:dm_exception_table_exit SourceFile:drivers/md/dm-snap.c SourceLine:692] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:dm_uevent_free SourceFile:drivers/md/dm-uevent.c SourceLine:41] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:dnotify_flush SourceFile:fs/notify/dnotify/dnotify.c SourceLine:176] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:dnotify_free_mark SourceFile:fs/notify/dnotify/dnotify.c SourceLine:136] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:dnotify_handle_event SourceFile:fs/notify/dnotify/dnotify.c SourceLine:118] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:dquot_destroy SourceFile:fs/quota/dquot.c SourceLine:559] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:drm_block_free SourceFile:drivers/gpu/drm/drm_buddy.c SourceLine:53] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:dst_destroy SourceFile:net/core/dst.c SourceLine:122] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:dsthash_free_rcu SourceFile:net/netfilter/xt_hashlimit.c SourceLine:262] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:dup_fd SourceFile:fs/file.c SourceLine:422] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:dwc2_desc_list_alloc SourceFile:drivers/usb/dwc2/hcd_ddma.c SourceLine:85] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:dwc2_desc_list_free SourceFile:drivers/usb/dwc2/hcd_ddma.c SourceLine:106] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:dwc2_hcd_qh_free SourceFile:drivers/usb/dwc2/hcd_queue.c SourceLine:1639] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ecryptfs_add_new_key_tfm SourceFile:fs/ecryptfs/crypto.c SourceLine:1537] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ecryptfs_destroy_crypt_stat SourceFile:fs/ecryptfs/crypto.c SourceLine:141] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ecryptfs_destroy_crypto SourceFile:fs/ecryptfs/crypto.c SourceLine:1505] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ecryptfs_destroy_mount_crypt_stat SourceFile:fs/ecryptfs/crypto.c SourceLine:160] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ecryptfs_dir_open SourceFile:fs/ecryptfs/file.c SourceLine:301] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ecryptfs_dir_release SourceFile:fs/ecryptfs/file.c SourceLine:331] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ecryptfs_free_fc SourceFile:fs/ecryptfs/main.c SourceLine:597] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ecryptfs_free_inode SourceFile:fs/ecryptfs/super.c SourceLine:58] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ecryptfs_generate_key_packet_set SourceFile:fs/ecryptfs/keystore.c SourceLine:2443] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ecryptfs_kill_block_super SourceFile:fs/ecryptfs/main.c SourceLine:585] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ecryptfs_open SourceFile:fs/ecryptfs/file.c SourceLine:262] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ecryptfs_parse_packet_set SourceFile:fs/ecryptfs/keystore.c SourceLine:1894] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ecryptfs_read_metadata SourceFile:fs/ecryptfs/crypto.c SourceLine:1346] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ecryptfs_release SourceFile:fs/ecryptfs/file.c SourceLine:323] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ecryptfs_write_inode_size_to_xattr SourceFile:fs/ecryptfs/mmap.c SourceLine:413] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:efs_free_inode SourceFile:fs/efs/super.c SourceLine:76] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:entry_free SourceFile:drivers/net/wireguard/ratelimiter.c SourceLine:43] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ep_insert SourceFile:fs/eventpoll.c SourceLine:1601] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ep_unregister_pollwait SourceFile:fs/eventpoll.c SourceLine:692] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:erofs_free_inode SourceFile:fs/erofs/super.c SourceLine:87] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:event_file_put SourceFile:kernel/trace/trace_events.c SourceLine:1296] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:event_file_put SourceFile:kernel/trace/trace_events.c SourceLine:1304] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:exfat_cache_free SourceFile:fs/exfat/cache.c SourceLine:71] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:exfat_free_inode SourceFile:fs/exfat/super.c SourceLine:204] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ext4_discard_work SourceFile:fs/ext4/mballoc.c SourceLine:3672] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ext4_discard_work SourceFile:fs/ext4/mballoc.c SourceLine:3685] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ext4_fc_cleanup SourceFile:fs/ext4/fast_commit.c SourceLine:1349] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ext4_fc_del SourceFile:fs/ext4/fast_commit.c SourceLine:304] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ext4_free_in_core_inode SourceFile:fs/ext4/super.c SourceLine:1448] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ext4_free_io_end_vec SourceFile:fs/ext4/page-io.c SourceLine:77] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ext4_mb_cleanup_pa SourceFile:fs/ext4/mballoc.c SourceLine:3881] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ext4_mb_free_metadata SourceFile:fs/ext4/mballoc.c SourceLine:6481] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ext4_mb_free_metadata SourceFile:fs/ext4/mballoc.c SourceLine:6494] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ext4_mb_free_metadata SourceFile:fs/ext4/mballoc.c SourceLine:6500] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ext4_mb_init_backend SourceFile:fs/ext4/mballoc.c SourceLine:3579] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ext4_mb_new_blocks SourceFile:fs/ext4/mballoc.c SourceLine:6361] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ext4_mb_pa_free SourceFile:fs/ext4/mballoc.c SourceLine:5150] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ext4_mb_release SourceFile:fs/ext4/mballoc.c SourceLine:3916] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ext4_merge_freed_extents SourceFile:fs/ext4/mballoc.c SourceLine:6403] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ext4_process_freed_data SourceFile:fs/ext4/mballoc.c SourceLine:4041] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ext4_release_io_end SourceFile:fs/ext4/page-io.c SourceLine:164] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_alloc_dic SourceFile:fs/f2fs/compress.c SourceLine:1707] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_alloc_nid_done SourceFile:fs/f2fs/node.c SourceLine:2737] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_alloc_nid_failed SourceFile:fs/f2fs/node.c SourceLine:2770] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_compress_write_end_io SourceFile:fs/f2fs/compress.c SourceLine:1506] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_del_fsync_node_entry SourceFile:fs/f2fs/node.c SourceLine:376] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_destroy_node_manager SourceFile:fs/f2fs/node.c SourceLine:3461] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_destroy_node_manager SourceFile:fs/f2fs/node.c SourceLine:3498] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_free_casefolded_name SourceFile:fs/f2fs/dir.c SourceLine:98] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_free_dic SourceFile:fs/f2fs/compress.c SourceLine:1784] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_free_inode SourceFile:fs/f2fs/super.c SourceLine:1952] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_init_casefolded_name SourceFile:fs/f2fs/dir.c SourceLine:80] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_release_ino_entry SourceFile:fs/f2fs/checkpoint.c SourceLine:814] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_try_to_free_nids SourceFile:fs/f2fs/node.c SourceLine:2794] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_write_compressed_pages SourceFile:fs/f2fs/compress.c SourceLine:1462] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fanotify_free_fid_event SourceFile:fs/notify/fanotify/fanotify.c SourceLine:1046] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fanotify_free_mark SourceFile:fs/notify/fanotify/fanotify.c SourceLine:1110] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fanotify_free_mnt_event SourceFile:fs/notify/fanotify/fanotify.c SourceLine:1064] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fanotify_free_path_event SourceFile:fs/notify/fanotify/fanotify.c SourceLine:1031] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fanotify_free_perm_event SourceFile:fs/notify/fanotify/fanotify.c SourceLine:1037] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fasync_free SourceFile:fs/fcntl.c SourceLine:1039] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fat_cache_free SourceFile:fs/fat/cache.c SourceLine:65] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fat_free_inode SourceFile:fs/fat/inode.c SourceLine:770] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fcloop_h2t_xmt_ls_rsp SourceFile:drivers/nvme/target/fcloop.c SourceLine:403] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fcloop_rport_lsrqst_work SourceFile:drivers/nvme/target/fcloop.c SourceLine:347] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fcloop_t2h_ls_req SourceFile:drivers/nvme/target/fcloop.c SourceLine:479] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fcloop_t2h_xmt_ls_rsp SourceFile:drivers/nvme/target/fcloop.c SourceLine:514] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fcloop_tport_lsrqst_work SourceFile:drivers/nvme/target/fcloop.c SourceLine:438] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fcntl_dirnotify SourceFile:fs/notify/dnotify/dnotify.c SourceLine:394] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fdb_create SourceFile:net/bridge/br_fdb.c SourceLine:414] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ffs_detach_free SourceFile:fs/f2fs/data.c SourceLine:2458] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fib_table_insert SourceFile:net/ipv4/fib_trie.c SourceLine:1388] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fib_trie_unmerge SourceFile:net/ipv4/fib_trie.c SourceLine:1912] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:file_free SourceFile:fs/file_table.c SourceLine:77] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:file_free SourceFile:fs/file_table.c SourceLine:79] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:flow_free SourceFile:net/openvswitch/flow_table.c SourceLine:120] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:flow_free SourceFile:net/openvswitch/flow_table.c SourceLine:124] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:flush_cache_ent SourceFile:fs/smb/client/dfs_cache.c SourceLine:134] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fq_gc SourceFile:net/sched/sch_fq.c SourceLine:292] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fq_rehash SourceFile:net/sched/sch_fq.c SourceLine:855] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fq_reset SourceFile:net/sched/sch_fq.c SourceLine:824] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:free_bitmap SourceFile:fs/btrfs/free-space-cache.c SourceLine:2141] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:free_bitmap SourceFile:fs/btrfs/free-space-cache.c SourceLine:2142] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:free_buffer SourceFile:drivers/md/dm-bufio.c SourceLine:1263] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:free_buffer_data SourceFile:drivers/md/dm-bufio.c SourceLine:1206] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:free_buffer_head SourceFile:fs/buffer.c SourceLine:3042] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:free_completed_exception SourceFile:drivers/md/dm-snap.c SourceLine:742] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:free_ephead SourceFile:fs/eventpoll.c SourceLine:286] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:free_event_rcu SourceFile:kernel/events/core.c SourceLine:5306] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:free_filename SourceFile:fs/namei.c SourceLine:147] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:free_fs_struct SourceFile:fs/fs_struct.c SourceLine:87] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:free_inode_nonrcu SourceFile:fs/inode.c SourceLine:318] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:free_ioctx SourceFile:fs/aio.c SourceLine:625] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:free_iova_mem SourceFile:drivers/iommu/iova.c SourceLine:237] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:free_kmem_cache_nodes SourceFile:mm/slub.c SourceLine:7562] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:free_object_list SourceFile:lib/debugobjects.c SourceLine:326] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:free_perf_ctx_data SourceFile:kernel/events/core.c SourceLine:5394] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:free_pref SourceFile:fs/btrfs/backref.c SourceLine:214] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:free_rmap_item SourceFile:mm/ksm.c SourceLine:577] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:free_signal_struct SourceFile:kernel/fork.c SourceLine:767] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:free_stable_node SourceFile:mm/ksm.c SourceLine:594] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:free_stripe SourceFile:drivers/md/raid5.c SourceLine:2346] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:free_task_struct SourceFile:kernel/fork.c SourceLine:190] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:free_user SourceFile:kernel/user.c SourceLine:167] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:free_vbuf SourceFile:drivers/gpu/drm/virtio/virtgpu_vq.c SourceLine:208] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:free_vfsmnt SourceFile:fs/namespace.c SourceLine:731] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fscache_free_cookie SourceFile:fs/netfs/fscache_cookie.c SourceLine:79] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fsverity_free_info SourceFile:fs/verity/open.c SourceLine:396] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fuse_alloc_inode SourceFile:fs/fuse/inode.c SourceLine:128] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fuse_free_inode SourceFile:fs/fuse/inode.c SourceLine:144] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fuse_request_free SourceFile:fs/fuse/dev.c SourceLine:151] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fwnet_free_ptask SourceFile:drivers/firewire/net.c SourceLine:810] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fwnet_tx SourceFile:drivers/firewire/net.c SourceLine:1347] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:gb_operation_create_common SourceFile:drivers/greybus/operation.c SourceLine:562] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:gb_operation_message_alloc SourceFile:drivers/greybus/operation.c SourceLine:390] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:gb_operation_message_free SourceFile:drivers/greybus/operation.c SourceLine:398] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:gfs2_clear_rgrpd SourceFile:fs/gfs2/rgrp.c SourceLine:742] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:gfs2_drain_revokes SourceFile:fs/gfs2/lops.c SourceLine:897] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:gfs2_free_inode SourceFile:fs/gfs2/super.c SourceLine:1473] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:gfs2_glock_dealloc SourceFile:fs/gfs2/glock.c SourceLine:136] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:gfs2_glock_dealloc SourceFile:fs/gfs2/glock.c SourceLine:138] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:gfs2_qa_get SourceFile:fs/gfs2/quota.c SourceLine:565] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:gfs2_qa_put SourceFile:fs/gfs2/quota.c SourceLine:578] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:gfs2_qd_dealloc SourceFile:fs/gfs2/quota.c SourceLine:111] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:gfs2_quota_init SourceFile:fs/gfs2/quota.c SourceLine:1473] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:gfs2_release_folio SourceFile:fs/gfs2/aops.c SourceLine:696] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:gfs2_remove_from_journal SourceFile:fs/gfs2/meta_io.c SourceLine:366] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:gfs2_trans_begin SourceFile:fs/gfs2/trans.c SourceLine:125] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:gfs2_trans_free SourceFile:fs/gfs2/trans.c SourceLine:358] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:gfs2_trans_remove_revoke SourceFile:fs/gfs2/trans.c SourceLine:340] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:hfs_free_inode SourceFile:fs/hfs/super.c SourceLine:179] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:hfsplus_destroy_attr_entry SourceFile:fs/hfsplus/attributes.c SourceLine:91] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:hfsplus_free_inode SourceFile:fs/hfsplus/super.c SourceLine:675] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:hpfs_free_inode SourceFile:fs/hpfs/super.c SourceLine:245] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:hugetlbfs_free_inode SourceFile:fs/hugetlbfs/inode.c SourceLine:1215] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:i915_active_acquire_preallocate_barrier SourceFile:drivers/gpu/drm/i915/i915_active.c SourceLine:915] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:i915_active_fini SourceFile:drivers/gpu/drm/i915/i915_active.c SourceLine:747] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:i915_dependency_free SourceFile:drivers/gpu/drm/i915/i915_scheduler.c SourceLine:325] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:i915_fence_release SourceFile:drivers/gpu/drm/i915/i915_request.c SourceLine:172] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:i915_gem_object_free SourceFile:drivers/gpu/drm/i915/gem/i915_gem_object.c SourceLine:92] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:i915_lut_handle_free SourceFile:drivers/gpu/drm/i915/gem/i915_gem_context.c SourceLine:101] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:i915_vma_free SourceFile:drivers/gpu/drm/i915/i915_vma.c SourceLine:70] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:i915_vma_resource_free SourceFile:drivers/gpu/drm/i915/i915_vma_resource.c SourceLine:66] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ima_iint_free SourceFile:security/integrity/ima/ima_iint.c SourceLine:79] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:inet_bind2_bucket_destroy SourceFile:net/ipv4/inet_hashtables.c SourceLine:173] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:inet_frag_destroy_rcu SourceFile:net/ipv4/inet_fragment.c SourceLine:298] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:inet_twsk_free SourceFile:net/ipv4/inet_timewait_sock.c SourceLine:80] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:inode_free_by_rcu SourceFile:security/security.c SourceLine:1204] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:inotify_free_mark SourceFile:fs/notify/inotify/inotify_fsnotify.c SourceLine:200] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:insert_into_bitmap SourceFile:fs/btrfs/free-space-cache.c SourceLine:2421] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:insert_into_bitmap SourceFile:fs/btrfs/free-space-cache.c SourceLine:2423] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:insert_tree SourceFile:net/netfilter/nf_conncount.c SourceLine:462] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:intel_engine_free_request_pool SourceFile:drivers/gpu/drm/i915/gt/intel_engine_cs.c SourceLine:705] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ioat3_alloc_sed SourceFile:drivers/dma/ioat/prep.c SourceLine:93] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ioat_free_ring_ent SourceFile:drivers/dma/ioat/dma.c SourceLine:368] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ioat_free_sed SourceFile:drivers/dma/ioat/dma.c SourceLine:526] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ioc_create_icq SourceFile:block/blk-ioc.c SourceLine:368] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ioc_create_icq SourceFile:block/blk-ioc.c SourceLine:387] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ioc_find_get_icq SourceFile:block/blk-ioc.c SourceLine:411] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ioc_release_fn SourceFile:block/blk-ioc.c SourceLine:137] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:iocb_destroy SourceFile:fs/aio.c SourceLine:1109] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ioctx_alloc SourceFile:fs/aio.c SourceLine:837] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:iova_magazine_free SourceFile:drivers/iommu/iova.c SourceLine:614] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ip6mr_cache_free_rcu SourceFile:net/ipv6/ip6mr.c SourceLine:778] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ip_vs_conn_rcu_free SourceFile:net/netfilter/ipvs/ip_vs_conn.c SourceLine:818] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ipmr_cache_free_rcu SourceFile:net/ipv4/ipmr.c SourceLine:727] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:irq_execute_cb SourceFile:drivers/gpu/drm/i915/i915_request.c SourceLine:189] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:iser_dataout_comp SourceFile:drivers/infiniband/ulp/iser/iser_initiator.c SourceLine:706] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:iser_send_data_out SourceFile:drivers/infiniband/ulp/iser/iser_initiator.c SourceLine:467] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:isofs_free_inode SourceFile:fs/isofs/inode.c SourceLine:82] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:jbd2_free SourceFile:fs/jbd2/journal.c SourceLine:2799] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:jbd2_free_handle SourceFile:include/linux/jbd2.h SourceLine:1595] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:jbd2_free_inode SourceFile:include/linux/jbd2.h SourceLine:1614] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:jbd2_journal_cancel_revoke SourceFile:fs/jbd2/revoke.c SourceLine:453] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:jbd2_journal_clear_revoke SourceFile:fs/jbd2/revoke.c SourceLine:740] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:jbd2_journal_destroy_revoke_table SourceFile:fs/jbd2/revoke.c SourceLine:259] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:jbd2_journal_free_transaction SourceFile:fs/jbd2/transaction.c SourceLine:62] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:jbd2_journal_init_revoke_table SourceFile:fs/jbd2/revoke.c SourceLine:236] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:jbd2_journal_write_revoke_records SourceFile:fs/jbd2/revoke.c SourceLine:558] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:jffs2_free_full_dnode SourceFile:fs/jffs2/malloc.c SourceLine:122] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:jffs2_free_inode SourceFile:fs/jffs2/super.c SourceLine:53] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:jffs2_free_inode_cache SourceFile:fs/jffs2/malloc.c SourceLine:257] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:jffs2_free_node_frag SourceFile:fs/jffs2/malloc.c SourceLine:243] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:jffs2_free_raw_dirent SourceFile:fs/jffs2/malloc.c SourceLine:136] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:jffs2_free_raw_inode SourceFile:fs/jffs2/malloc.c SourceLine:150] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:jffs2_free_refblock SourceFile:fs/jffs2/malloc.c SourceLine:229] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:jffs2_free_tmp_dnode_info SourceFile:fs/jffs2/malloc.c SourceLine:165] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:jffs2_free_xattr_datum SourceFile:fs/jffs2/malloc.c SourceLine:278] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:jffs2_free_xattr_ref SourceFile:fs/jffs2/malloc.c SourceLine:297] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:jfs_free_inode SourceFile:fs/jfs/super.c SourceLine:116] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:journal_free_journal_head SourceFile:fs/jbd2/journal.c SourceLine:2860] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:kcm_attach SourceFile:net/kcm/kcmsock.c SourceLine:1291] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:kcm_attach SourceFile:net/kcm/kcmsock.c SourceLine:1299] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:kcm_unattach SourceFile:net/kcm/kcmsock.c SourceLine:1462] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:kernfs_free_rcu SourceFile:fs/kernfs/dir.c SourceLine:552] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:kernfs_free_rcu SourceFile:fs/kernfs/dir.c SourceLine:555] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:key_alloc SourceFile:security/keys/key.c SourceLine:330] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:key_alloc SourceFile:security/keys/key.c SourceLine:342] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:key_gc_unused_keys SourceFile:security/keys/gc.c SourceLine:167] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:kfree_skb_partial SourceFile:net/core/skbuff.c SourceLine:6148] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:kfree_skbmem SourceFile:net/core/skbuff.c SourceLine:1151] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:kfree_skbmem SourceFile:net/core/skbuff.c SourceLine:1172] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:kmem_buckets_create SourceFile:mm/slab_common.c SourceLine:499] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ksmbd_alloc_work_struct SourceFile:fs/smb/server/ksmbd_work.c SourceLine:34] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ksmbd_free_work_struct SourceFile:fs/smb/server/ksmbd_work.c SourceLine:61] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ksmbd_open_fd SourceFile:fs/smb/server/vfs_cache.c SourceLine:772] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:kvm_arch_vcpu_create SourceFile:arch/x86/kvm/x86.c SourceLine:12819] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:kvm_arch_vcpu_destroy SourceFile:arch/x86/kvm/x86.c SourceLine:12861] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:kvm_clear_async_pf_completion_queue SourceFile:virt/kvm/async_pf.c SourceLine:133] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:kvm_flush_and_free_async_pf_work SourceFile:virt/kvm/async_pf.c SourceLine:117] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:kvm_gmem_free_inode SourceFile:virt/kvm/guest_memfd.c SourceLine:958] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:kvm_mmu_free_memory_cache SourceFile:virt/kvm/kvm_main.c SourceLine:418] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:kvm_mmu_free_shadow_page SourceFile:arch/x86/kvm/mmu/mmu.c SourceLine:1827] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:kvm_vcpu_destroy SourceFile:virt/kvm/kvm_main.c SourceLine:480] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:kvm_vm_ioctl_create_vcpu SourceFile:virt/kvm/kvm_main.c SourceLine:4270] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:locks_free_lease SourceFile:fs/locks.c SourceLine:370] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:locks_free_lock SourceFile:fs/locks.c SourceLine:363] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:locks_free_lock_context SourceFile:fs/locks.c SourceLine:269] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:locks_get_lock_context SourceFile:fs/locks.c SourceLine:210] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:mb_cache_entry_create SourceFile:fs/mbcache.c SourceLine:111] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:mempool_free_slab SourceFile:mm/mempool.c SourceLine:729] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:mesh_rmc_check SourceFile:net/mac80211/mesh.c SourceLine:248] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:mesh_rmc_free SourceFile:net/mac80211/mesh.c SourceLine:206] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:minix_free_in_core_inode SourceFile:fs/minix/inode.c SourceLine:91] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:mm_init SourceFile:kernel/fork.c SourceLine:1147] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:mm_slot_free SourceFile:mm/mm_slot.h SourceLine:33] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:mmu_free_pte_list_desc SourceFile:arch/x86/kvm/mmu/mmu.c SourceLine:634] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:mon_text_read_t SourceFile:drivers/usb/mon/mon_text.c SourceLine:424] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:mon_text_read_u SourceFile:drivers/usb/mon/mon_text.c SourceLine:472] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:mon_text_release SourceFile:drivers/usb/mon/mon_text.c SourceLine:673] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:mqueue_free_inode SourceFile:ipc/mqueue.c SourceLine:509] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:net_alloc SourceFile:net/core/net_namespace.c SourceLine:507] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:net_complete_free SourceFile:net/core/net_namespace.c SourceLine:526] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nf_conncount_cache_free SourceFile:net/netfilter/nf_conncount.c SourceLine:655] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nf_conntrack_free SourceFile:net/netfilter/nf_conntrack_core.c SourceLine:1747] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nf_ct_expect_free_rcu SourceFile:net/netfilter/nf_conntrack_expect.c SourceLine:397] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nfs4_alloc_stid SourceFile:fs/nfsd/nfs4state.c SourceLine:939] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nfs4_free_deleg SourceFile:fs/nfsd/nfs4state.c SourceLine:1046] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nfs4_free_lockowner SourceFile:fs/nfsd/nfs4state.c SourceLine:8088] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nfs4_free_ol_stateid SourceFile:fs/nfsd/nfs4state.c SourceLine:1549] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nfs4_free_openowner SourceFile:fs/nfsd/nfs4state.c SourceLine:4998] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nfs4_xattr_free_cache_cb SourceFile:fs/nfs/nfs42xattr.c SourceLine:283] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nfs_direct_req_free SourceFile:fs/nfs/direct.c SourceLine:213] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nfs_free_inode SourceFile:fs/nfs/inode.c SourceLine:2544] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nfs_page_free SourceFile:fs/nfs/pagelist.c SourceLine:144] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nfs_readhdr_free SourceFile:fs/nfs/read.c SourceLine:52] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nfsd4_alloc_layout_stateid SourceFile:fs/nfsd/nfs4layouts.c SourceLine:261] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nfsd4_cleanup_open_state SourceFile:fs/nfsd/nfs4state.c SourceLine:6570] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nfsd4_cleanup_open_state SourceFile:fs/nfsd/nfs4state.c SourceLine:6574] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nfsd4_free_layout_stateid SourceFile:fs/nfsd/nfs4layouts.c SourceLine:193] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nfsd4_free_layouts SourceFile:fs/nfsd/nfs4layouts.c SourceLine:474] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nfsd4_insert_layout SourceFile:fs/nfsd/nfs4layouts.c SourceLine:461] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nfsd_cacherep_free SourceFile:fs/nfsd/nfscache.c SourceLine:117] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nfsd_file_mark_free SourceFile:fs/nfsd/filecache.c SourceLine:135] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nfsd_file_slab_free SourceFile:fs/nfsd/filecache.c SourceLine:126] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nilfs_btree_free_path SourceFile:fs/nilfs2/btree.c SourceLine:52] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nilfs_free_inode SourceFile:fs/nilfs2/super.c SourceLine:175] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nilfs_segbuf_free SourceFile:fs/nilfs2/segbuf.c SourceLine:57] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nilfs_transaction_abort SourceFile:fs/nilfs2/segment.c SourceLine:311] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nilfs_transaction_begin SourceFile:fs/nilfs2/segment.c SourceLine:238] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nilfs_transaction_commit SourceFile:fs/nilfs2/segment.c SourceLine:287] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:node_free_immediate SourceFile:net/ipv6/ip6_fib.c SourceLine:197] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:node_free_rcu SourceFile:drivers/net/wireguard/allowedips.c SourceLine:53] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nsproxy_free SourceFile:kernel/nsproxy.c SourceLine:73] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ntfs_free_inode SourceFile:fs/ntfs3/super.c SourceLine:653] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ocfs2_destroy_dquot SourceFile:fs/ocfs2/quota_global.c SourceLine:1025] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ocfs2_free_inode SourceFile:fs/ocfs2/super.c SourceLine:567] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ocfs2_load_local_quota_bitmaps SourceFile:fs/ocfs2/quota_local.c SourceLine:270] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ocfs2_local_quota_add_chunk SourceFile:fs/ocfs2/quota_local.c SourceLine:1086] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ocfs2_purge_copied_metadata_tree SourceFile:fs/ocfs2/uptodate.c SourceLine:142] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ocfs2_release_local_quota_bitmaps SourceFile:fs/ocfs2/quota_local.c SourceLine:244] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ocfs2_remove_block_from_cache SourceFile:fs/ocfs2/uptodate.c SourceLine:579] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:op_release SourceFile:fs/orangefs/orangefs-cache.c SourceLine:160] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:orangefs_free_inode SourceFile:fs/orangefs/super.c SourceLine:120] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ovl_free_inode SourceFile:fs/overlayfs/super.c SourceLine:210] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ovs_flow_alloc SourceFile:net/openvswitch/flow_table.c SourceLine:99] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:p9_fcall_fini SourceFile:net/9p/client.c SourceLine:130] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:p9_req_put SourceFile:net/9p/client.c SourceLine:286] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:p9_tag_alloc SourceFile:net/9p/client.c SourceLine:223] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:page_array_free SourceFile:fs/f2fs/compress.c SourceLine:44] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:parse_tag_1_packet SourceFile:fs/ecryptfs/keystore.c SourceLine:1291] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:parse_tag_3_packet SourceFile:fs/ecryptfs/keystore.c SourceLine:1468] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:pcpu_get_vm_areas SourceFile:mm/vmalloc.c SourceLine:5088] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:pde_free SourceFile:fs/proc/generic.c SourceLine:43] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ppl_io_pool_alloc SourceFile:drivers/md/raid5-ppl.c SourceLine:216] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ppl_io_pool_free SourceFile:drivers/md/raid5-ppl.c SourceLine:229] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:preload_this_cpu_lock SourceFile:mm/vmalloc.c SourceLine:1914] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:proc_free_inode SourceFile:fs/proc/inode.c SourceLine:80] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:proc_reg_open SourceFile:fs/proc/inode.c SourceLine:523] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ptlock_free SourceFile:mm/memory.c SourceLine:7479] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:put_clnt_odstate SourceFile:fs/nfsd/nfs4state.c SourceLine:879] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:put_cred_rcu SourceFile:kernel/cred.c SourceLine:62] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:put_crypt_info SourceFile:fs/crypto/keysetup.c SourceLine:576] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:put_files_struct SourceFile:fs/file.c SourceLine:514] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:put_gc_inode SourceFile:fs/f2fs/gc.c SourceLine:1014] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:put_io_context SourceFile:block/blk-ioc.c SourceLine:202] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:put_pid SourceFile:kernel/pid.c SourceLine:98] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:qd_alloc SourceFile:fs/gfs2/quota.c SourceLine:253] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:qd_get SourceFile:fs/gfs2/quota.c SourceLine:310] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:qh_free SourceFile:drivers/usb/isp1760/isp1760-hcd.c SourceLine:678] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:qnx4_free_inode SourceFile:fs/qnx4/inode.c SourceLine:366] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:qnx6_free_inode SourceFile:fs/qnx6/inode.c SourceLine:595] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:qtd_free SourceFile:drivers/usb/isp1760/isp1760-hcd.c SourceLine:997] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:queue_realm_cap_snaps SourceFile:fs/ceph/snap.c SourceLine:768] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:radix_tree_cpu_dead SourceFile:lib/radix-tree.c SourceLine:1588] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:radix_tree_node_rcu_free SourceFile:lib/radix-tree.c SourceLine:304] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:rcu_context_free SourceFile:drivers/gpu/drm/i915/gt/intel_context.c SourceLine:32] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:rcu_release SourceFile:drivers/net/wireguard/peer.c SourceLine:197] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:rds_conn_destroy SourceFile:net/rds/connection.c SourceLine:545] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:rds_ib_recv_free_caches SourceFile:net/rds/ib_recv.c SourceLine:171] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:rds_ib_recv_free_caches SourceFile:net/rds/ib_recv.c SourceLine:182] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:rds_ib_refill_one_frag SourceFile:net/rds/ib_recv.c SourceLine:297] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:rds_tcp_conn_free SourceFile:net/rds/tcp.c SourceLine:366] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:rds_tcp_inc_free SourceFile:net/rds/tcp_recv.c SourceLine:57] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:read_rindex_entry SourceFile:fs/gfs2/rgrp.c SourceLine:954] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:release_configfs_dirent SourceFile:fs/configfs/configfs_internal.h SourceLine:140] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:release_discard_addr SourceFile:fs/f2fs/segment.c SourceLine:2140] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:release_lbr_buffers SourceFile:arch/x86/events/intel/lbr.c SourceLine:633] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:release_sit_entry_set SourceFile:fs/f2fs/segment.c SourceLine:4604] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:release_system_zone SourceFile:fs/ext4/block_validity.c SourceLine:61] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:release_victim_entry SourceFile:fs/f2fs/gc.c SourceLine:709] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:remove_free_nid SourceFile:fs/f2fs/node.c SourceLine:2487] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:reqsk_alloc_noprof SourceFile:net/ipv4/inet_connection_sock.c SourceLine:864] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:romfs_free_inode SourceFile:fs/romfs/super.c SourceLine:378] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:root_free_rcu SourceFile:drivers/net/wireguard/allowedips.c SourceLine:65] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:rpc_free_inode SourceFile:net/sunrpc/rpc_pipe.c SourceLine:210] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:rxrpc_rcu_free_call SourceFile:net/rxrpc/call_object.c SourceLine:675] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:sas_alloc_event SourceFile:drivers/scsi/libsas/sas_init.c SourceLine:664] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:sas_alloc_slow_task SourceFile:drivers/scsi/libsas/sas_init.c SourceLine:46] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:sas_free_event SourceFile:drivers/scsi/libsas/sas_init.c SourceLine:677] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:sas_free_task SourceFile:drivers/scsi/libsas/sas_init.c SourceLine:63] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:sched_free_group SourceFile:kernel/sched/core.c SourceLine:9042] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:schedule_ptds SourceFile:drivers/usb/isp1760/isp1760-hcd.c SourceLine:1227] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:scsi_mq_exit_request SourceFile:drivers/scsi/scsi_lib.c SourceLine:1987] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:scsi_mq_init_request SourceFile:drivers/scsi/scsi_lib.c SourceLine:1973] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:sctp_bucket_destroy SourceFile:net/sctp/socket.c SourceLine:8767] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:sctp_chunk_destroy SourceFile:net/sctp/sm_make_chunk.c SourceLine:1499] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:security_file_free SourceFile:security/security.c SourceLine:2417] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:seq_release SourceFile:fs/seq_file.c SourceLine:357] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:set_task_ioprio SourceFile:block/blk-ioc.c SourceLine:274] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:set_task_ioprio SourceFile:block/blk-ioc.c SourceLine:278] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:shared_policy_replace SourceFile:mm/mempolicy.c SourceLine:3183] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:shmem_free_in_core_inode SourceFile:mm/shmem.c SourceLine:5177] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:sk_prot_alloc SourceFile:net/core/sock.c SourceLine:2261] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:sk_prot_free SourceFile:net/core/sock.c SourceLine:2282] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:skb_kfree_head SourceFile:net/core/skbuff.c SourceLine:1087] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:slab_kmem_cache_release SourceFile:mm/slab_common.c SourceLine:524] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:sock_free_inode SourceFile:net/socket.c SourceLine:343] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:sp_alloc SourceFile:mm/mempolicy.c SourceLine:3124] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:sp_free SourceFile:mm/mempolicy.c SourceLine:2967] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:squashfs_free_inode SourceFile:fs/squashfs/super.c SourceLine:681] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ssh_ctrl_packet_free SourceFile:drivers/platform/surface/aggregator/ssh_packet_layer.c SourceLine:655] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:start_transaction SourceFile:fs/btrfs/transaction.c SourceLine:805] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:stub_free_priv_and_urb SourceFile:drivers/usb/usbip/stub_main.c SourceLine:321] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:swap_table_free SourceFile:mm/swapfile.c SourceLine:441] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:taskstats_tgid_alloc SourceFile:kernel/taskstats.c SourceLine:592] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:taskstats_tgid_free SourceFile:include/linux/taskstats_kern.h SourceLine:22] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:tdp_mmu_alloc_sp_for_split SourceFile:arch/x86/kvm/mmu/tdp_mmu.c SourceLine:1512] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:tdp_mmu_free_sp SourceFile:arch/x86/kvm/mmu/tdp_mmu.c SourceLine:60] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:trace_destroy_fields SourceFile:kernel/trace/trace_events.c SourceLine:228] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:tracefs_free_inode SourceFile:fs/tracefs/inode.c SourceLine:60] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:trans_drain SourceFile:fs/gfs2/log.c SourceLine:1008] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:trans_drain SourceFile:fs/gfs2/log.c SourceLine:1016] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:transport_free_session SourceFile:drivers/target/target_core_transport.c SourceLine:639] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:trim_no_bitmap SourceFile:fs/btrfs/free-space-cache.c SourceLine:3785] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:trim_no_bitmap SourceFile:fs/btrfs/free-space-cache.c SourceLine:3797] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:try_merge_free_space SourceFile:fs/btrfs/free-space-cache.c SourceLine:2475] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:try_merge_free_space SourceFile:fs/btrfs/free-space-cache.c SourceLine:2486] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ubi_free_aeb SourceFile:drivers/mtd/ubi/attach.c SourceLine:205] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ubifs_free_inode SourceFile:fs/ubifs/super.c SourceLine:286] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:udf_free_in_core_inode SourceFile:fs/udf/super.c SourceLine:175] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ufs_free_in_core_inode SourceFile:fs/ufs/super.c SourceLine:1374] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:uhci_free_urb_priv SourceFile:drivers/usb/host/uhci-q.c SourceLine:754] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:unreserve_psock SourceFile:net/kcm/kcmsock.c SourceLine:556] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:userfaultfd_ctx_put SourceFile:fs/userfaultfd.c SourceLine:177] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:v9fs_free_inode SourceFile:fs/9p/vfs_inode.c SourceLine:246] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:va_clip SourceFile:mm/vmalloc.c SourceLine:1723] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:vm_area_dup SourceFile:mm/vma_init.c SourceLine:133] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:vm_area_free SourceFile:mm/vma_init.c SourceLine:151] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:vxfs_free_inode SourceFile:fs/freevxfs/vxfs_super.c SourceLine:114] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:wg_peer_create SourceFile:drivers/net/wireguard/peer.c SourceLine:67] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:wipe_auth_tok_list SourceFile:fs/ecryptfs/keystore.c SourceLine:1161] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:wl_entry_destroy SourceFile:drivers/mtd/ubi/wl.c SourceLine:178] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:wnd_add_free_ext SourceFile:fs/ntfs3/bitmap.c SourceLine:284] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:wnd_add_free_ext SourceFile:fs/ntfs3/bitmap.c SourceLine:314] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:wnd_close SourceFile:fs/ntfs3/bitmap.c SourceLine:136] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:wnd_remove_free_ext SourceFile:fs/ntfs3/bitmap.c SourceLine:415] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:wnd_remove_free_ext SourceFile:fs/ntfs3/bitmap.c SourceLine:451] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:x6spi_destroy_rcu SourceFile:net/ipv6/xfrm6_tunnel.c SourceLine:183] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xattr_free SourceFile:fs/f2fs/xattr.c SourceLine:42] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfrm_state_free SourceFile:net/xfrm/xfrm_state.c SourceLine:591] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_attr_free_item SourceFile:fs/xfs/xfs_attr_item.c SourceLine:466] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_attrd_item_free SourceFile:fs/xfs/xfs_attr_item.c SourceLine:303] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_attri_item_free SourceFile:fs/xfs/xfs_attr_item.c SourceLine:136] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_bmap_update_cancel_item SourceFile:fs/xfs/xfs_bmap_item.c SourceLine:385] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_btree_del_cursor SourceFile:fs/xfs/libxfs/xfs_btree.c SourceLine:534] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_bud_item_release SourceFile:fs/xfs/xfs_bmap_item.c SourceLine:214] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_buf_free_callback SourceFile:fs/xfs/xfs_buf.c SourceLine:99] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_buf_item_free SourceFile:fs/xfs/xfs_buf_item.c SourceLine:68] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_buf_item_init SourceFile:fs/xfs/xfs_buf_item.c SourceLine:895] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_bui_item_free SourceFile:fs/xfs/xfs_bmap_item.c SourceLine:45] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_cud_item_release SourceFile:fs/xfs/xfs_refcount_item.c SourceLine:227] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_cui_item_free SourceFile:fs/xfs/xfs_refcount_item.c SourceLine:46] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_da_state_free SourceFile:fs/xfs/libxfs/xfs_da_btree.c SourceLine:119] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_defer_finish_one SourceFile:fs/xfs/libxfs/xfs_defer.c SourceLine:620] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_defer_pending_cancel_work SourceFile:fs/xfs/libxfs/xfs_defer.c SourceLine:358] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_efd_item_free SourceFile:fs/xfs/xfs_extfree_item.c SourceLine:249] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_efi_item_free SourceFile:fs/xfs/xfs_extfree_item.c SourceLine:52] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_exchmaps_cancel_item SourceFile:fs/xfs/xfs_exchmaps_item.c SourceLine:285] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_exchmaps_estimate SourceFile:fs/xfs/libxfs/xfs_exchmaps.c SourceLine:1138] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_extent_free_cancel_item SourceFile:fs/xfs/xfs_extfree_item.c SourceLine:518] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_icreate_item_release SourceFile:fs/xfs/xfs_icreate_item.c SourceLine:65] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_inode_alloc SourceFile:fs/xfs/xfs_icache.c SourceLine:100] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_inode_free_callback SourceFile:fs/xfs/xfs_icache.c SourceLine:156] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_inode_free_callback SourceFile:fs/xfs/xfs_icache.c SourceLine:164] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_inode_item_destroy SourceFile:fs/xfs/xfs_inode_item.c SourceLine:953] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_iunlink_item_release SourceFile:fs/xfs/xfs_iunlink_item.c SourceLine:35] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_log_ticket_put SourceFile:fs/xfs/xfs_log.c SourceLine:3005] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_parent_finish SourceFile:fs/xfs/libxfs/xfs_parent.h SourceLine:79] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_qm_dqdestroy SourceFile:fs/xfs/xfs_dquot.c SourceLine:110] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_refcount_update_cancel_item SourceFile:fs/xfs/xfs_refcount_item.c SourceLine:396] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_rmap_update_cancel_item SourceFile:fs/xfs/xfs_rmap_item.c SourceLine:421] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_rud_item_release SourceFile:fs/xfs/xfs_rmap_item.c SourceLine:228] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_rui_item_free SourceFile:fs/xfs/xfs_rmap_item.c SourceLine:46] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_trans_free SourceFile:fs/xfs/xfs_trans.c SourceLine:79] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_trans_free_dqinfo SourceFile:fs/xfs/xfs_trans_dquot.c SourceLine:1052] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_xmd_item_release SourceFile:fs/xfs/xfs_exchmaps_item.c SourceLine:191] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xfs_xmi_item_free SourceFile:fs/xfs/xfs_exchmaps_item.c SourceLine:46] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xsk_consume_skb SourceFile:net/xdp/xsk.c SourceLine:665] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:xsk_cq_submit_addr_locked SourceFile:net/xdp/xsk.c SourceLine:616] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:z_erofs_free_pcluster SourceFile:fs/erofs/zdata.c SourceLine:282] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:zonefs_free_inode SourceFile:fs/zonefs/super.c SourceLine:435] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:zswap_entry_cache_free SourceFile:mm/zswap.c SourceLine:710]] TruncatedOutput:false]
|
| 36/2 |
2026/05/24 08:19 |
llm |
expert |
0m
Model:
Tokens:
input: 86179
output: 28
thoughts: 561
Thoughts: **Analyzing a GFS2 Inode Freeing Scenario**
Okay, so I'm looking at `gfs2_free_inode`. It seems straightforward: VFS calls this when `i_count` hits zero. That's good, so the inode should be safe from being freed prematurely. But... I need to consider a subtle race condition. Could `chown_common` be called on a file descriptor, and that file descriptor be closed concurrently? If so, `fget` or `fdget` would still have a reference on the `struct file`.
Right, `do_fchownat` uses `user_path_at`. And `user_path_at` uses `getname` and `filename_lookup`. If that directory file descriptor (`dfd`) *is* a file descriptor, `filename_lookup` would grab the `struct file` with `fdget`, and from there, gets the path. And since it increments the refcounts of both the dentry and the vfsmount, the `path` definitely holds a ref to the dentry, which holds a ref to the inode. So, the inode shouldn't be freed.
But wait, what if the inode isn't freed, but somehow its `i_rwsem` gets corrupted? Could there be a buffer overflow, or a use-after-free bug that's trashing memory *near* the `gfs2_inode`? Let's look at this crash.
The slab information shows: `slab gfs2_inode start ffff888047e8c8e0 pointer offset 304 size 1568`. The critical error message says `list_del corruption. prev->next should be ffffc9000e0bfae0, but was ffff888047e8ca10. (prev=ffff888047e8ca10)`.
That address, `ffff888047e8ca10`, is... EXACTLY where `sem->wait_list` should be! If this was random, that value should be garbage, but it is not. It means `sem->wait_list` was reinitialized, to be empty!
So, who could be reinitializing `sem->wait_list`? Hmm, only two functions do that: `init_rwsem` and `__init_rwsem`. I should look for those functions being called in the gfs2 code, and see if there is something amiss.
|
| 37/2 |
2026/05/24 08:19 |
tool |
codesearch-find-references |
0m
Error:
Args: map[IncludeSnippetLines:0 Name:init_rwsem]
Results: map[References:<nil> TruncatedOutput:false]
|
| 38/2 |
2026/05/24 08:19 |
llm |
expert |
0m
Model:
Tokens:
input: 87334
output: 22
thoughts: 12
Thoughts: Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person:
**Initial Impression: Macro Recognition**
Alright, so the first thing that jumps out at me here is that `init_rwsem` is *definitely* a macro. No ambiguity there. That's immediately where my mind goes. It's a key function, and seeing it like that, my mental model starts to assume that it's just a shorthand, a preprocessor trick to handle the basic initialization of a reader/writer semaphore structure. My brain is already starting to piece together what it *might* be expanding to β probably some assignments to the internal fields, perhaps setting the reader count to zero and some flags to indicate the semaphore's initial state. And perhaps, it will use atomic instructions to make sure the process is thread-safe. I'm already anticipating what to expect when I dive deeper into its definition.
|
| 39/2 |
2026/05/24 08:19 |
tool |
grepper |
0m
Error:
Args: map[Expression:init_rwsem.*gfs2]
Results:
|
| 40/2 |
2026/05/24 08:19 |
llm |
expert |
0m
Model:
Tokens:
input: 87580
output: 18
thoughts: 19
Thoughts: Here's my thought process, as requested:
**Investigating GFS2 Initialization**
Okay, so I need to understand how the read/write semaphore is initialized within the GFS2 filesystem. My first instinct, and the most direct approach, is to use `grep`. I'll focus the search on the `fs/gfs2` directory, as that's where the core GFS2 code resides. The specific keyword I'm looking for is `init_rwsem`. This should give me a quick list of places within the GFS2 codebase where this function, or macro, is called or defined. From there, I can start tracing back through the call stack to see where and when this crucial semaphore is actually initialized and what parameters are being passed to it. This approach gives me a high probability of success quickly to identify the relevant code location. I'm hoping this will lead me to the relevant initialization sequence, potentially revealing details about resource contention and protection within the GFS2 structure.
|
| 41/2 |
2026/05/24 08:19 |
tool |
grepper |
0m
Args: map[Expression:init_rwsem]
Results: map[Output:
Full output is too long, showing 500 out of 1452 lines.
Use more precise expression if possible.
[Documentation/locking/percpu-rw-semaphore.rst=18=The lock is declared with "struct percpu_rw_semaphore" type.
Documentation/locking/percpu-rw-semaphore.rst:19:The lock is initialized with percpu_init_rwsem, it returns 0 on success
Documentation/locking/percpu-rw-semaphore.rst-20-and -ENOMEM on allocation failure.
--
arch/s390/kvm/kvm-s390.c=3138=static void kvm_s390_crypto_init(struct kvm *kvm)
--
arch/s390/kvm/kvm-s390.c-3141- kvm_s390_set_crycb_format(kvm);
arch/s390/kvm/kvm-s390.c:3142: init_rwsem(&kvm->arch.crypto.pqap_hook_rwsem);
arch/s390/kvm/kvm-s390.c-3143-
--
arch/x86/include/asm/mmu_context.h=55=static inline void init_new_context_ldt(struct mm_struct *mm)
--
arch/x86/include/asm/mmu_context.h-57- mm->context.ldt = NULL;
arch/x86/include/asm/mmu_context.h:58: init_rwsem(&mm->context.ldt_usr_sem);
arch/x86/include/asm/mmu_context.h-59-}
--
arch/x86/kvm/x86.c=10324=static void kvm_apicv_init(struct kvm *kvm)
--
arch/x86/kvm/x86.c-10330-
arch/x86/kvm/x86.c:10331: init_rwsem(&kvm->arch.apicv_update_lock);
arch/x86/kvm/x86.c-10332-}
--
block/blk-crypto-profile.c=74=int blk_crypto_profile_init(struct blk_crypto_profile *profile,
--
block/blk-crypto-profile.c-88- lockdep_register_key(&profile->lockdep_key);
block/blk-crypto-profile.c:89: __init_rwsem(&profile->lock, "&profile->lock", &profile->lockdep_key);
block/blk-crypto-profile.c-90-
--
block/blk-mq.c=4843=int blk_mq_alloc_tag_set(struct blk_mq_tag_set *set)
--
block/blk-mq.c-4899-
block/blk-mq.c:4900: init_rwsem(&set->update_nr_hwq_lock);
block/blk-mq.c-4901-
--
drivers/accel/amdxdna/amdxdna_pci_drv.c=259=static int amdxdna_probe(struct pci_dev *pdev, const struct pci_device_id *id)
--
drivers/accel/amdxdna/amdxdna_pci_drv.c-273- drmm_mutex_init(&xdna->ddev, &xdna->dev_lock);
drivers/accel/amdxdna/amdxdna_pci_drv.c:274: init_rwsem(&xdna->notifier_lock);
drivers/accel/amdxdna/amdxdna_pci_drv.c-275- INIT_LIST_HEAD(&xdna->client_list);
--
drivers/accel/habanalabs/common/debugfs.c=2049=int hl_debugfs_device_init(struct hl_device *hdev)
--
drivers/accel/habanalabs/common/debugfs.c-2070- mutex_init(&dev_entry->file_mutex);
drivers/accel/habanalabs/common/debugfs.c:2071: init_rwsem(&dev_entry->state_dump_sem);
drivers/accel/habanalabs/common/debugfs.c-2072- spin_lock_init(&dev_entry->cb_spinlock);
--
drivers/accel/ivpu/ivpu_pm.c=396=void ivpu_pm_init(struct ivpu_device *vdev)
--
drivers/accel/ivpu/ivpu_pm.c-403-
drivers/accel/ivpu/ivpu_pm.c:404: init_rwsem(&pm->reset_lock);
drivers/accel/ivpu/ivpu_pm.c-405- atomic_set(&pm->reset_pending, 0);
--
drivers/acpi/cppc_acpi.c=683=int acpi_cppc_processor_probe(struct acpi_processor *pr)
--
drivers/acpi/cppc_acpi.c-881-
drivers/acpi/cppc_acpi.c:882: init_rwsem(&pcc_data[pcc_subspace_id]->pcc_lock);
drivers/acpi/cppc_acpi.c-883- init_waitqueue_head(&pcc_data[pcc_subspace_id]->pcc_write_wait_q);
--
drivers/block/rbd.c=5351=static struct rbd_device *__rbd_dev_create(struct rbd_spec *spec)
--
drivers/block/rbd.c-5360- INIT_LIST_HEAD(&rbd_dev->node);
drivers/block/rbd.c:5361: init_rwsem(&rbd_dev->header_rwsem);
drivers/block/rbd.c-5362-
--
drivers/block/rbd.c-5376-
drivers/block/rbd.c:5377: init_rwsem(&rbd_dev->lock_rwsem);
drivers/block/rbd.c-5378- rbd_dev->lock_state = RBD_LOCK_STATE_UNLOCKED;
--
drivers/block/zram/zram_drv.c=3042=static int zram_add(void)
--
drivers/block/zram/zram_drv.c-3079-
drivers/block/zram/zram_drv.c:3080: init_rwsem(&zram->dev_lock);
drivers/block/zram/zram_drv.c-3081-#ifdef CONFIG_ZRAM_WRITEBACK
--
drivers/bluetooth/hci_ldisc.c=479=static int hci_uart_tty_open(struct tty_struct *tty)
--
drivers/bluetooth/hci_ldisc.c-498- }
drivers/bluetooth/hci_ldisc.c:499: if (percpu_init_rwsem(&hu->proto_lock)) {
drivers/bluetooth/hci_ldisc.c-500- BT_ERR("Can't allocate semaphore structure");
--
drivers/bluetooth/hci_serdev.c=303=int hci_uart_register_device_priv(struct hci_uart *hu,
--
drivers/bluetooth/hci_serdev.c-313-
drivers/bluetooth/hci_serdev.c:314: if (percpu_init_rwsem(&hu->proto_lock))
drivers/bluetooth/hci_serdev.c-315- return -ENOMEM;
--
drivers/char/tpm/tpm-chip.c=292=struct tpm_chip *tpm_chip_alloc(struct device *pdev,
--
drivers/char/tpm/tpm-chip.c-302- mutex_init(&chip->tpm_mutex);
drivers/char/tpm/tpm-chip.c:303: init_rwsem(&chip->ops_sem);
drivers/char/tpm/tpm-chip.c-304-
--
drivers/comedi/comedi_fops.c=105=static void comedi_device_init(struct comedi_device *dev)
--
drivers/comedi/comedi_fops.c-109- mutex_init(&dev->mutex);
drivers/comedi/comedi_fops.c:110: init_rwsem(&dev->attach_lock);
drivers/comedi/comedi_fops.c-111- dev->minor = -1;
--
drivers/cpufreq/cpufreq.c=1257=static struct cpufreq_policy *cpufreq_policy_alloc(unsigned int cpu)
--
drivers/cpufreq/cpufreq.c-1292-
drivers/cpufreq/cpufreq.c:1293: init_rwsem(&policy->rwsem);
drivers/cpufreq/cpufreq.c-1294-
--
drivers/crypto/hisilicon/qm.c=3065=static void hisi_qm_pre_init(struct hisi_qm *qm)
--
drivers/crypto/hisilicon/qm.c-3080- mutex_init(&qm->ifc_lock);
drivers/crypto/hisilicon/qm.c:3081: init_rwsem(&qm->qps_lock);
drivers/crypto/hisilicon/qm.c-3082- qm->qp_in_used = 0;
--
drivers/crypto/intel/qat/qat_common/adf_cfg.c=67=int adf_cfg_dev_add(struct adf_accel_dev *accel_dev)
--
drivers/crypto/intel/qat/qat_common/adf_cfg.c-74- INIT_LIST_HEAD(&dev_cfg_data->sec_list);
drivers/crypto/intel/qat/qat_common/adf_cfg.c:75: init_rwsem(&dev_cfg_data->lock);
drivers/crypto/intel/qat/qat_common/adf_cfg.c-76- accel_dev->cfg = dev_cfg_data;
--
drivers/crypto/intel/qat/qat_common/adf_rl.c=1049=int adf_rl_init(struct adf_accel_dev *accel_dev)
--
drivers/crypto/intel/qat/qat_common/adf_rl.c-1076- rl->accel_dev = accel_dev;
drivers/crypto/intel/qat/qat_common/adf_rl.c:1077: init_rwsem(&rl->user_input.lock);
drivers/crypto/intel/qat/qat_common/adf_rl.c-1078- accel_dev->rate_limiting = rl;
--
drivers/fwctl/main.c=293=_alloc_device(struct device *parent, const struct fwctl_ops *ops, size_t size)
--
drivers/fwctl/main.c-308-
drivers/fwctl/main.c:309: init_rwsem(&fwctl->registration_lock);
drivers/fwctl/main.c-310- mutex_init(&fwctl->uctx_list_lock);
--
drivers/gnss/core.c=223=struct gnss_device *gnss_allocate_device(struct device *parent)
--
drivers/gnss/core.c-250-
drivers/gnss/core.c:251: init_rwsem(&gdev->rwsem);
drivers/gnss/core.c-252- mutex_init(&gdev->read_mutex);
--
drivers/gpu/drm/amd/amdgpu/amdgpu_reset.c=274=struct amdgpu_reset_domain *amdgpu_reset_create_reset_domain(enum amdgpu_reset_domain_type type,
--
drivers/gpu/drm/amd/amdgpu/amdgpu_reset.c-297- atomic_set(&reset_domain->reset_res, 0);
drivers/gpu/drm/amd/amdgpu/amdgpu_reset.c:298: init_rwsem(&reset_domain->sem);
drivers/gpu/drm/amd/amdgpu/amdgpu_reset.c-299-
--
drivers/gpu/drm/amd/amdkfd/kfd_topology.c=996=int kfd_topology_init(void)
--
drivers/gpu/drm/amd/amdkfd/kfd_topology.c-1014- INIT_LIST_HEAD(&temp_topology_device_list);
drivers/gpu/drm/amd/amdkfd/kfd_topology.c:1015: init_rwsem(&topology_lock);
drivers/gpu/drm/amd/amdkfd/kfd_topology.c-1016-
--
drivers/gpu/drm/drm_gpusvm.c=383=int drm_gpusvm_init(struct drm_gpusvm *gpusvm,
--
drivers/gpu/drm/drm_gpusvm.c-413-
drivers/gpu/drm/drm_gpusvm.c:414: init_rwsem(&gpusvm->notifier_lock);
drivers/gpu/drm/drm_gpusvm.c-415-
--
drivers/gpu/drm/gma500/mmu.c=420=struct psb_mmu_driver *psb_mmu_driver_init(struct drm_device *dev,
--
drivers/gpu/drm/gma500/mmu.c-439- spin_lock_init(&driver->lock);
drivers/gpu/drm/gma500/mmu.c:440: init_rwsem(&driver->sem);
drivers/gpu/drm/gma500/mmu.c-441- down_write(&driver->sem);
--
drivers/gpu/drm/imagination/pvr_drv.c=1400=pvr_probe(struct platform_device *plat_dev)
--
drivers/gpu/drm/imagination/pvr_drv.c-1418-
drivers/gpu/drm/imagination/pvr_drv.c:1419: init_rwsem(&pvr_dev->reset_sem);
drivers/gpu/drm/imagination/pvr_drv.c-1420-
--
drivers/gpu/drm/panthor/panthor_heap.c=536=panthor_heap_pool_create(struct panthor_device *ptdev, struct panthor_vm *vm)
--
drivers/gpu/drm/panthor/panthor_heap.c-552- pool->ptdev = ptdev;
drivers/gpu/drm/panthor/panthor_heap.c:553: init_rwsem(&pool->lock);
drivers/gpu/drm/panthor/panthor_heap.c-554- xa_init_flags(&pool->xa, XA_FLAGS_ALLOC);
--
drivers/gpu/drm/radeon/radeon_device.c=1278=int radeon_device_init(struct radeon_device *rdev,
--
drivers/gpu/drm/radeon/radeon_device.c-1313- mutex_init(&rdev->audio.component_mutex);
drivers/gpu/drm/radeon/radeon_device.c:1314: init_rwsem(&rdev->pm.mclk_lock);
drivers/gpu/drm/radeon/radeon_device.c:1315: init_rwsem(&rdev->exclusive_lock);
drivers/gpu/drm/radeon/radeon_device.c-1316- init_waitqueue_head(&rdev->irq.vblank_queue);
--
drivers/gpu/drm/vmwgfx/vmwgfx_cmd.c=97=struct vmw_fifo_state *vmw_fifo_create(struct vmw_private *dev_priv)
--
drivers/gpu/drm/vmwgfx/vmwgfx_cmd.c-120- mutex_init(&fifo->fifo_mutex);
drivers/gpu/drm/vmwgfx/vmwgfx_cmd.c:121: init_rwsem(&fifo->rwsem);
drivers/gpu/drm/vmwgfx/vmwgfx_cmd.c-122- min = 4;
--
drivers/gpu/drm/xe/xe_device.c=438=struct xe_device *xe_device_create(struct pci_dev *pdev,
--
drivers/gpu/drm/xe/xe_device.c-482-
drivers/gpu/drm/xe/xe_device.c:483: init_rwsem(&xe->usm.lock);
drivers/gpu/drm/xe/xe_device.c-484-
--
drivers/gpu/drm/xe/xe_hw_engine_group.c=45=hw_engine_group_alloc(struct xe_device *xe)
--
drivers/gpu/drm/xe/xe_hw_engine_group.c-61-
drivers/gpu/drm/xe/xe_hw_engine_group.c:62: init_rwsem(&group->mode_sem);
drivers/gpu/drm/xe/xe_hw_engine_group.c-63- INIT_WORK(&group->resume_work, hw_engine_group_resume_lr_jobs_func);
--
drivers/gpu/drm/xe/xe_validation.h=157=xe_validation_device_init(struct xe_validation_device *val)
drivers/gpu/drm/xe/xe_validation.h-158-{
drivers/gpu/drm/xe/xe_validation.h:159: init_rwsem(&val->lock);
drivers/gpu/drm/xe/xe_validation.h-160-}
--
drivers/gpu/drm/xe/xe_vm.c=1477=struct xe_vm *xe_vm_create(struct xe_device *xe, u32 flags, struct xe_file *xef)
--
drivers/gpu/drm/xe/xe_vm.c-1514-
drivers/gpu/drm/xe/xe_vm.c:1515: __init_rwsem(&vm->lock, "gsc_vm", &gsc_vm_key);
drivers/gpu/drm/xe/xe_vm.c-1516- } else {
drivers/gpu/drm/xe/xe_vm.c:1517: init_rwsem(&vm->lock);
drivers/gpu/drm/xe/xe_vm.c-1518- }
--
drivers/i3c/master.c=500=static int i3c_bus_init(struct i3c_bus *i3cbus, struct device_node *np)
--
drivers/i3c/master.c-503-
drivers/i3c/master.c:504: init_rwsem(&i3cbus->lock);
drivers/i3c/master.c-505- INIT_LIST_HEAD(&i3cbus->devs.i2c);
--
drivers/infiniband/core/device.c=569=struct ib_device *_ib_alloc_device(size_t size, struct net *net)
--
drivers/infiniband/core/device.c-597- spin_lock_init(&device->qp_open_list_lock);
drivers/infiniband/core/device.c:598: init_rwsem(&device->event_handler_rwsem);
drivers/infiniband/core/device.c-599- mutex_init(&device->unregistration_lock);
--
drivers/infiniband/core/device.c-604- xa_init_flags(&device->client_data, XA_FLAGS_ALLOC);
drivers/infiniband/core/device.c:605: init_rwsem(&device->client_data_rwsem);
drivers/infiniband/core/device.c-606- xa_init_flags(&device->compat_devs, XA_FLAGS_ALLOC);
--
drivers/infiniband/core/netlink.c=291=void rdma_nl_init(void)
--
drivers/infiniband/core/netlink.c-295- for (idx = 0; idx < RDMA_NL_NUM_CLIENTS; idx++)
drivers/infiniband/core/netlink.c:296: init_rwsem(&rdma_nl_types[idx].sem);
drivers/infiniband/core/netlink.c-297-}
--
drivers/infiniband/core/uverbs_main.c=929=static int ib_uverbs_open(struct inode *inode, struct file *filp)
--
drivers/infiniband/core/uverbs_main.c-983- INIT_LIST_HEAD(&file->uobjects);
drivers/infiniband/core/uverbs_main.c:984: init_rwsem(&file->hw_destroy_rwsem);
drivers/infiniband/core/uverbs_main.c-985- mutex_init(&file->umap_lock);
--
drivers/infiniband/core/verbs.c=2536=struct ib_xrcd *ib_alloc_xrcd_user(struct ib_device *device,
--
drivers/infiniband/core/verbs.c-2551- atomic_set(&xrcd->usecnt, 0);
drivers/infiniband/core/verbs.c:2552: init_rwsem(&xrcd->tgt_qps_rwsem);
drivers/infiniband/core/verbs.c-2553- xa_init(&xrcd->tgt_qps);
--
drivers/infiniband/hw/erdma/erdma_verbs.c=991=int erdma_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs,
--
drivers/infiniband/hw/erdma/erdma_verbs.c-1015-
drivers/infiniband/hw/erdma/erdma_verbs.c:1016: init_rwsem(&qp->state_lock);
drivers/infiniband/hw/erdma/erdma_verbs.c-1017- kref_init(&qp->ref);
--
drivers/infiniband/sw/siw/siw_verbs.c=309=int siw_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs,
--
drivers/infiniband/sw/siw/siw_verbs.c-366-
drivers/infiniband/sw/siw/siw_verbs.c:367: init_rwsem(&qp->state_lock);
drivers/infiniband/sw/siw/siw_verbs.c-368- spin_lock_init(&qp->sq_lock);
--
drivers/iommu/iommufd/io_pagetable.c=926=void iopt_init_table(struct io_pagetable *iopt)
drivers/iommu/iommufd/io_pagetable.c-927-{
drivers/iommu/iommufd/io_pagetable.c:928: init_rwsem(&iopt->iova_rwsem);
drivers/iommu/iommufd/io_pagetable.c:929: init_rwsem(&iopt->domains_rwsem);
drivers/iommu/iommufd/io_pagetable.c-930- iopt->area_itree = RB_ROOT_CACHED;
--
drivers/iommu/iommufd/main.c=295=static int iommufd_fops_open(struct inode *inode, struct file *filp)
--
drivers/iommu/iommufd/main.c-312-
drivers/iommu/iommufd/main.c:313: init_rwsem(&ictx->ioas_creation_lock);
drivers/iommu/iommufd/main.c-314- xa_init_flags(&ictx->objects, XA_FLAGS_ALLOC1 | XA_FLAGS_ACCOUNT);
--
drivers/iommu/iommufd/selftest.c=1012=static struct mock_dev *mock_dev_create(unsigned long dev_flags)
--
drivers/iommu/iommufd/selftest.c-1029-
drivers/iommu/iommufd/selftest.c:1030: init_rwsem(&mdev->viommu_rwsem);
drivers/iommu/iommufd/selftest.c-1031- device_initialize(&mdev->dev);
--
drivers/iommu/iommufd/viommu.c=17=int iommufd_viommu_alloc_ioctl(struct iommufd_ucmd *ucmd)
--
drivers/iommu/iommufd/viommu.c-83- INIT_LIST_HEAD(&viommu->veventqs);
drivers/iommu/iommufd/viommu.c:84: init_rwsem(&viommu->veventqs_rwsem);
drivers/iommu/iommufd/viommu.c-85- /*
--
drivers/leds/led-class.c=484=int led_classdev_register_ext(struct device *parent,
--
drivers/leds/led-class.c-557-#ifdef CONFIG_LEDS_TRIGGERS
drivers/leds/led-class.c:558: init_rwsem(&led_cdev->trigger_lock);
drivers/leds/led-class.c-559-#endif
--
drivers/leds/leds-bd2802.c=659=static int bd2802_probe(struct i2c_client *client)
--
drivers/leds/leds-bd2802.c-699-
drivers/leds/leds-bd2802.c:700: init_rwsem(&led->rwsem);
drivers/leds/leds-bd2802.c-701-
--
drivers/md/bcache/btree.c=581=static struct btree *mca_bucket_alloc(struct cache_set *c,
--
drivers/md/bcache/btree.c-592-
drivers/md/bcache/btree.c:593: init_rwsem(&b->lock);
drivers/md/bcache/btree.c-594- lock_set_cmp_fn(&b->lock, btree_lock_cmp_fn, btree_lock_print_fn);
--
drivers/md/bcache/writeback.c=1047=void bch_cached_dev_writeback_init(struct cached_dev *dc)
--
drivers/md/bcache/writeback.c-1049- sema_init(&dc->in_flight, 64);
drivers/md/bcache/writeback.c:1050: init_rwsem(&dc->writeback_lock);
drivers/md/bcache/writeback.c-1051- bch_keybuf_init(&dc->writeback_keys);
--
drivers/md/dm-bufio.c=543=static void cache_init(struct dm_buffer_cache *bc, unsigned int num_locks, bool no_sleep)
--
drivers/md/dm-bufio.c-553- else
drivers/md/dm-bufio.c:554: init_rwsem(&bc->trees[i].u.lock);
drivers/md/dm-bufio.c-555- bc->trees[i].root = RB_ROOT;
--
drivers/md/dm-cache-metadata.c=754=static struct dm_cache_metadata *metadata_open(struct block_device *bdev,
--
drivers/md/dm-cache-metadata.c-770- refcount_set(&cmd->ref_count, 1);
drivers/md/dm-cache-metadata.c:771: init_rwsem(&cmd->root_lock);
drivers/md/dm-cache-metadata.c-772- cmd->bdev = bdev;
--
drivers/md/dm-cache-target.c=2380=static int cache_create(struct cache_args *ca, struct cache **result)
--
drivers/md/dm-cache-target.c-2574-
drivers/md/dm-cache-target.c:2575: init_rwsem(&cache->background_work_lock);
drivers/md/dm-cache-target.c-2576- prevent_background_work(cache);
--
drivers/md/dm-clone-metadata.c=549=struct dm_clone_metadata *dm_clone_metadata_open(struct block_device *bdev,
--
drivers/md/dm-clone-metadata.c-567-
drivers/md/dm-clone-metadata.c:568: init_rwsem(&cmd->lock);
drivers/md/dm-clone-metadata.c-569- spin_lock_init(&cmd->bitmap_lock);
--
drivers/md/dm-snap.c=353=static int init_origin_hash(void)
--
drivers/md/dm-snap.c-373-
drivers/md/dm-snap.c:374: init_rwsem(&_origins_lock);
drivers/md/dm-snap.c-375-
--
drivers/md/dm-snap.c=1230=static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv)
--
drivers/md/dm-snap.c-1308- s->out_of_order_tree = RB_ROOT;
drivers/md/dm-snap.c:1309: init_rwsem(&s->lock);
drivers/md/dm-snap.c-1310- INIT_LIST_HEAD(&s->list);
--
drivers/md/dm-thin-metadata.c=953=struct dm_pool_metadata *dm_pool_metadata_open(struct block_device *bdev,
--
drivers/md/dm-thin-metadata.c-965-
drivers/md/dm-thin-metadata.c:966: init_rwsem(&pmd->root_lock);
drivers/md/dm-thin-metadata.c-967- pmd->time = 0;
--
drivers/md/dm-thin.c=154=static void throttle_init(struct throttle *t)
drivers/md/dm-thin.c-155-{
drivers/md/dm-thin.c:156: init_rwsem(&t->lock);
drivers/md/dm-thin.c-157- t->throttle_applied = false;
--
drivers/md/dm-zoned-metadata.c=2861=int dmz_ctr_metadata(struct dmz_dev *dev, int num_dev,
--
drivers/md/dm-zoned-metadata.c-2877- zmd->mblk_rbtree = RB_ROOT;
drivers/md/dm-zoned-metadata.c:2878: init_rwsem(&zmd->mblk_sem);
drivers/md/dm-zoned-metadata.c-2879- mutex_init(&zmd->mblk_flush_lock);
--
drivers/mfd/intel-m10-bmc-core.c=188=int m10bmc_dev_init(struct intel_m10bmc *m10bmc, const struct intel_m10bmc_platform_info *info)
--
drivers/mfd/intel-m10-bmc-core.c-193- dev_set_drvdata(m10bmc->dev, m10bmc);
drivers/mfd/intel-m10-bmc-core.c:194: init_rwsem(&m10bmc->bmcfw_lock);
drivers/mfd/intel-m10-bmc-core.c-195-
--
drivers/misc/mei/init.c=370=void mei_device_init(struct mei_device *dev,
--
drivers/misc/mei/init.c-379- mutex_init(&dev->device_lock);
drivers/misc/mei/init.c:380: init_rwsem(&dev->me_clients_rwsem);
drivers/misc/mei/init.c-381- mutex_init(&dev->cl_bus_lock);
--
drivers/misc/sgi-gru/grufile.c=252=static int gru_init_tables(unsigned long gru_base_paddr, void *gru_base_vaddr)
--
drivers/misc/sgi-gru/grufile.c-273- spin_lock_init(&gru_base[bid]->bs_lock);
drivers/misc/sgi-gru/grufile.c:274: init_rwsem(&gru_base[bid]->bs_kgts_sema);
drivers/misc/sgi-gru/grufile.c-275-
--
drivers/misc/vmw_balloon.c=1812=static int __init vmballoon_init(void)
--
drivers/misc/vmw_balloon.c-1835- spin_lock_init(&balloon.comm_lock);
drivers/misc/vmw_balloon.c:1836: init_rwsem(&balloon.conf_sem);
drivers/misc/vmw_balloon.c-1837- balloon.vmci_doorbell = VMCI_INVALID_HANDLE;
--
drivers/mtd/ubi/build.c=849=int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num,
--
drivers/mtd/ubi/build.c-983- spin_lock_init(&ubi->volumes_lock);
drivers/mtd/ubi/build.c:984: init_rwsem(&ubi->fm_protect);
drivers/mtd/ubi/build.c:985: init_rwsem(&ubi->fm_eba_sem);
drivers/mtd/ubi/build.c-986-
--
drivers/mtd/ubi/eba.c=245=static struct ubi_ltree_entry *ltree_add_entry(struct ubi_device *ubi,
--
drivers/mtd/ubi/eba.c-254- le->users = 0;
drivers/mtd/ubi/eba.c:255: init_rwsem(&le->mutex);
drivers/mtd/ubi/eba.c-256- le->vol_id = vol_id;
--
drivers/mtd/ubi/wl.c=1799=int ubi_wl_init(struct ubi_device *ubi, struct ubi_attach_info *ai)
--
drivers/mtd/ubi/wl.c-1809- mutex_init(&ubi->move_mutex);
drivers/mtd/ubi/wl.c:1810: init_rwsem(&ubi->work_sem);
drivers/mtd/ubi/wl.c-1811- ubi->max_ec = ai->max_ec;
--
drivers/net/ethernet/mellanox/mlx4/cmd.c=2489=int mlx4_cmd_init(struct mlx4_dev *dev)
--
drivers/net/ethernet/mellanox/mlx4/cmd.c-2494- if (!priv->cmd.initialized) {
drivers/net/ethernet/mellanox/mlx4/cmd.c:2495: init_rwsem(&priv->cmd.switch_sem);
drivers/net/ethernet/mellanox/mlx4/cmd.c-2496- mutex_init(&priv->cmd.slave_cmd_mutex);
--
drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.c=471=mlx5e_rx_res_create(struct mlx5_core_dev *mdev, enum mlx5e_rx_res_features features,
--
drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.c-489- res->pkt_merge_param = *pkt_merge_param;
drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.c:490: init_rwsem(&res->pkt_merge_param_sem);
drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.c-491-
--
drivers/net/ethernet/mellanox/mlx5/core/eswitch.c=2018=int mlx5_eswitch_init(struct mlx5_core_dev *dev)
--
drivers/net/ethernet/mellanox/mlx5/core/eswitch.c-2072- mutex_init(&esw->state_lock);
drivers/net/ethernet/mellanox/mlx5/core/eswitch.c:2073: init_rwsem(&esw->mode_lock);
drivers/net/ethernet/mellanox/mlx5/core/eswitch.c-2074- refcount_set(&esw->qos.refcnt, 0);
--
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c=377=static void tree_init_node(struct fs_node *node,
--
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c-383- INIT_LIST_HEAD(&node->children);
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c:384: init_rwsem(&node->lock);
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c-385- node->del_hw_func = del_hw_func;
--
drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c=118=mlx5_devcom_comp_alloc(u64 id, const struct mlx5_devcom_match_attr *attr,
--
drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c-132- comp->handler = handler;
drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c:133: init_rwsem(&comp->sem);
drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c-134- lockdep_register_key(&comp->lock_key);
--
drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c=308=static int ionic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
--
drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c-359-
drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c:360: init_rwsem(&ionic->vf_op_lock);
drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c-361- num_vfs = pci_num_vf(pdev);
--
drivers/net/ethernet/sfc/efx_common.c=961=int efx_init_struct(struct efx_nic *efx, struct pci_dev *pci_dev)
--
drivers/net/ethernet/sfc/efx_common.c-993- mutex_init(&efx->mac_lock);
drivers/net/ethernet/sfc/efx_common.c:994: init_rwsem(&efx->filter_sem);
drivers/net/ethernet/sfc/efx_common.c-995-#ifdef CONFIG_RFS_ACCEL
--
drivers/net/ethernet/sfc/falcon/efx.c=1677=static int ef4_probe_filters(struct ef4_nic *efx)
--
drivers/net/ethernet/sfc/falcon/efx.c-1681- spin_lock_init(&efx->filter_lock);
drivers/net/ethernet/sfc/falcon/efx.c:1682: init_rwsem(&efx->filter_sem);
drivers/net/ethernet/sfc/falcon/efx.c-1683- mutex_lock(&efx->mac_lock);
--
drivers/net/ethernet/sfc/mcdi_filters.c=1301=int efx_mcdi_filter_table_probe(struct efx_nic *efx, bool multicast_chaining)
--
drivers/net/ethernet/sfc/mcdi_filters.c-1348- INIT_LIST_HEAD(&table->vlan_list);
drivers/net/ethernet/sfc/mcdi_filters.c:1349: init_rwsem(&table->lock);
drivers/net/ethernet/sfc/mcdi_filters.c-1350-
--
drivers/net/ethernet/sfc/siena/efx_common.c=986=int efx_siena_init_struct(struct efx_nic *efx,
--
drivers/net/ethernet/sfc/siena/efx_common.c-1020- mutex_init(&efx->mac_lock);
drivers/net/ethernet/sfc/siena/efx_common.c:1021: init_rwsem(&efx->filter_sem);
drivers/net/ethernet/sfc/siena/efx_common.c-1022-#ifdef CONFIG_RFS_ACCEL
--
drivers/net/ethernet/sfc/siena/farch.c=2787=int efx_farch_filter_table_probe(struct efx_nic *efx)
--
drivers/net/ethernet/sfc/siena/farch.c-2796- efx->filter_state = state;
drivers/net/ethernet/sfc/siena/farch.c:2797: init_rwsem(&state->lock);
drivers/net/ethernet/sfc/siena/farch.c-2798-
--
drivers/net/ppp/ppp_generic.c=2924=int ppp_register_net_channel(struct net *net, struct ppp_channel *chan)
--
drivers/net/ppp/ppp_generic.c-2942-#endif /* CONFIG_PPP_MULTILINK */
drivers/net/ppp/ppp_generic.c:2943: init_rwsem(&pch->chan_sem);
drivers/net/ppp/ppp_generic.c-2944- spin_lock_init(&pch->downl);
--
drivers/net/wireguard/cookie.c=19=void wg_cookie_checker_init(struct cookie_checker *checker,
--
drivers/net/wireguard/cookie.c-21-{
drivers/net/wireguard/cookie.c:22: init_rwsem(&checker->secret_lock);
drivers/net/wireguard/cookie.c-23- checker->secret_birthdate = ktime_get_coarse_boottime_ns();
--
drivers/net/wireguard/cookie.c=69=void wg_cookie_init(struct cookie *cookie)
--
drivers/net/wireguard/cookie.c-71- memset(cookie, 0, sizeof(*cookie));
drivers/net/wireguard/cookie.c:72: init_rwsem(&cookie->lock);
drivers/net/wireguard/cookie.c-73-}
--
drivers/net/wireguard/device.c=310=static int wg_newlink(struct net_device *dev,
--
drivers/net/wireguard/device.c-318- rcu_assign_pointer(wg->creating_net, link_net);
drivers/net/wireguard/device.c:319: init_rwsem(&wg->static_identity.lock);
drivers/net/wireguard/device.c-320- mutex_init(&wg->socket_update_lock);
--
drivers/net/wireguard/noise.c=59=void wg_noise_handshake_init(struct noise_handshake *handshake,
--
drivers/net/wireguard/noise.c-65- memset(handshake, 0, sizeof(*handshake));
drivers/net/wireguard/noise.c:66: init_rwsem(&handshake->lock);
drivers/net/wireguard/noise.c-67- handshake->entry.type = INDEX_HASHTABLE_HANDSHAKE;
--
drivers/net/wireless/ath/wil6210/main.c=685=int wil_priv_init(struct wil6210_priv *wil)
--
drivers/net/wireless/ath/wil6210/main.c-719- init_waitqueue_head(&wil->wq);
drivers/net/wireless/ath/wil6210/main.c:720: init_rwsem(&wil->mem_lock);
drivers/net/wireless/ath/wil6210/main.c-721-
--
]
]
|
| 42/2 |
2026/05/24 08:19 |
llm |
expert |
0m
Model:
Tokens:
input: 99236
output: 29
thoughts: 910
Thoughts: **The Inode Allocation Conundrum**
Okay, let me think this through. `init_rwsem`... right, that's called within `inode_init_always_gfp`, which is itself invoked by `alloc_inode_sb`. So, basically, every single time an inode is allocated, that reader-writer semaphore `i_rwsem` gets initialized. And if the inode is freed and then reallocated, the `i_rwsem` is *re*initialized. Got it.
Now, imagine a task is waiting on that semaphore, and the inode gets freed. The task, still technically waiting, will wake up to find the wait queue empty after the re-initialization, but its internal list pointers aren't updated properly. It's still pointing back to the head of the list for it's previous wait! Then, when it tries to clean up its own list entry with `list_del`, it checks `prev->next == entry`. The previous one is the head, the next one is now the head. BOOM! `list_del` throws a BUG. Bingo. This totally explains the crash β a use-after-free scenario involving the inode.
But, hang on, how can `chown_common` even *use* an inode after it's freed? It holds a reference to the dentry, which holds a reference to the inode, so the inode shouldn't be freed. Unless the filesystem is being unmounted, but that's ruled out because it's holding a reference to the mount point as well. Maybe the inode isn't the one from the dentry? What if it's a negative dentry, and `chown_common` is called on it? If `dentry->d_inode` is NULL, then `inode_lock_killable(NULL)` would crash with a NULL pointer dereference. The crash is happening within the `i_rwsem` member, 216 bytes in, however, not at address 216. And the address is valid, so `inode` is not NULL!
Perhaps `chown_common` is called on a dentry that was just unlinked. The inode is still valid until `dentry_iput` is called. But `chown_common` is holding onto the dentry, so `dentry_iput` can't be called, so this is also ruled out.
Hmm, unless... unless there's a bug in `gfs2` that bypasses the VFS and directly frees the inode memory? Let's double-check `gfs2_free_inode`. Yep, it's called by VFS when the `i_count` drops to zero. Could `gfs2` somehow call `kmem_cache_free(gfs2_inode_cachep, ip)` directly? I should really search the `fs/gfs2` code for calls to `kmem_cache_free(gfs2_inode_cachep`. That would be interesting.
|
| 43/2 |
2026/05/24 08:20 |
tool |
grepper |
0m
Args: map[Expression:kmem_cache_free.*gfs2_inode_cachep]
Results: map[Output:fs/gfs2/super.c=1471=static void gfs2_free_inode(struct inode *inode)
fs/gfs2/super.c-1472-{
fs/gfs2/super.c:1473: kmem_cache_free(gfs2_inode_cachep, GFS2_I(inode));
fs/gfs2/super.c-1474-}
]
|
| 44/2 |
2026/05/24 08:20 |
llm |
expert |
0m
Model:
Tokens:
input: 100938
output: 38
thoughts: 538
Thoughts: **Analyzing a Potential Race Condition in `chown_common`**
Okay, so I'm focusing on a potential problem involving inode freeing and `chown_common`. The trigger appears to be in `gfs2_free_inode`, which is registered as the `free_inode` function in `super_operations`. This means VFS calls it. The question is, can VFS free an inode while a function like `chown_common` is potentially still using it?
Let's re-examine `chown_common`. Specifically, I see that the code grabs `path->dentry->d_inode`. **Here's the critical point: this read happens *without* holding a lock!** That instantly throws up a red flag. Could `path->dentry->d_inode` change concurrently?
Think about it. If `path->dentry` is a positive dentry (meaning it represents an existing file), could it somehow become negative (meaning the file is gone) while `chown_common` is running? The obvious mechanism for that would be an unlinking operation. If a file is unlinked, `vfs_unlink` calls `d_delete(dentry)`.
But wait. `d_delete` doesn't *clear* `d_inode`, it just unhashes the dentry. The `d_inode` is cleared in `dentry_unlink_inode`, which is called by `__dentry_kill`. And `__dentry_kill` is only called when the dentry's reference count drops to zero.
However, `chown_common` itself *holds* a reference to the dentry via the `path` structure, and it is at least 1. Thus, `__dentry_kill` *cannot* be called, the inode *cannot* be cleared, and therefore the inode *cannot* be freed while `chown_common` is running. Right?
But wait... What if the dentry is some kind of "fake" dentry, or not the dentry of the file, or if the `path` is somehow invalid? My gut is telling me there may be a race condition in `chown_common`, so let's check it again, in the proper context. I should check `chown_common` in `fs/open.c`.
|
| 45/2 |
2026/05/24 08:20 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:fs/open.c IncludeLines:true Name:chown_common]
Results: map[SourceCode: 741: int chown_common(const struct path *path, uid_t user, gid_t group)
742: {
743: struct mnt_idmap *idmap;
744: struct user_namespace *fs_userns;
745: struct inode *inode = path->dentry->d_inode;
746: struct delegated_inode delegated_inode = { };
747: int error;
748: struct iattr newattrs;
749: kuid_t uid;
750: kgid_t gid;
751:
752: uid = make_kuid(current_user_ns(), user);
753: gid = make_kgid(current_user_ns(), group);
754:
755: idmap = mnt_idmap(path->mnt);
756: fs_userns = i_user_ns(inode);
757:
758: retry_deleg:
759: newattrs.ia_vfsuid = INVALID_VFSUID;
760: newattrs.ia_vfsgid = INVALID_VFSGID;
761: newattrs.ia_valid = ATTR_CTIME;
762: if ((user != (uid_t)-1) && !setattr_vfsuid(&newattrs, uid))
763: return -EINVAL;
764: if ((group != (gid_t)-1) && !setattr_vfsgid(&newattrs, gid))
765: return -EINVAL;
766: error = inode_lock_killable(inode);
767: if (error)
768: return error;
769: if (!S_ISDIR(inode->i_mode))
770: newattrs.ia_valid |= ATTR_KILL_SUID | ATTR_KILL_PRIV |
771: setattr_should_drop_sgid(idmap, inode);
772: /* Continue to send actual fs values, not the mount values. */
773: error = security_path_chown(
774: path,
775: from_vfsuid(idmap, fs_userns, newattrs.ia_vfsuid),
776: from_vfsgid(idmap, fs_userns, newattrs.ia_vfsgid));
777: if (!error)
778: error = notify_change(idmap, path->dentry, &newattrs,
779: &delegated_inode);
780: inode_unlock(inode);
781: if (is_delegated(&delegated_inode)) {
782: error = break_deleg_wait(&delegated_inode);
783: if (!error)
784: goto retry_deleg;
785: }
786: return error;
787: }
SourceFile:fs/open.c]
|
| 46/2 |
2026/05/24 08:20 |
llm |
expert |
0m
Model:
Tokens:
input: 102836
output: 23
thoughts: 370
Thoughts: **Debugging a GFS2 Filesystem Crash**
Okay, so I'm diving into this crash report, and the clues are starting to come together, slowly but surely. First things first, I need to understand the relationship between `chown_common`, `mnt_want_write`, and inode management. I was initially under the impression that `chown_common` was responsible for requesting write access via `mnt_want_write`, but that's wrong. The calling function, `do_fchownat`, takes care of calling `mnt_want_write`.
So, `chown_common` gets called *after* the mount point write lock has been acquired. It's holding a reference to the dentry, and the write reference to the vfsmount. This means the inode shouldn't be freed. That immediately throws a wrench into my understanding, because I'm seeing an `init_rwsem` call. How can you initialize a read-write semaphore on an inode that's *supposed* to be in use?
My initial thought was that perhaps `gfs2` somehow reinitializes the `i_rwsem` somewhere. I've already grepped for `init_rwsem` within the `fs/gfs2` directory, but I came up empty. Okay, I was missing something.
Then it hits me! `gfs2_init_inode_once` *does* call `init_rwsem`... but it's on `ip->i_rw_mutex`, not `inode->i_rwsem`! Wait a second, those are different structures. I need to be more precise in my searching. I'm focusing on the wrong mutex... I need to be sure. Let's make sure...
The crash message is giving me a slab allocation hint. Specifically, it tells me that the gfs2_inode is where it's crashing. The slab offset of the problem is 304, which is 2432 bits. Let's look again at the `gfs2_inode` layout to be sure.
|
| 47/2 |
2026/05/24 08:20 |
tool |
codesearch-struct-layout |
0m
Args:
Results: map[Fields:[map[Name:i_inode OffsetBits:0 SizeBits:9152] map[Name:i_no_addr OffsetBits:9152 SizeBits:64] map[Name:i_no_formal_ino OffsetBits:9216 SizeBits:64] map[Name:i_generation OffsetBits:9280 SizeBits:64] map[Name:i_eattr OffsetBits:9344 SizeBits:64] map[Name:i_flags OffsetBits:9408 SizeBits:64] map[Name:i_gl OffsetBits:9472 SizeBits:64] map[Name:i_iopen_gh OffsetBits:9536 SizeBits:448] map[Name:i_qadata OffsetBits:9984 SizeBits:64] map[Name:i_rgd_gh OffsetBits:10048 SizeBits:448] map[Name:i_res OffsetBits:10496 SizeBits:384] map[Name:i_goal OffsetBits:10880 SizeBits:64] map[Name:i_sizehint OffsetBits:10944 SizeBits:32] map[Name:i_rw_mutex OffsetBits:11008 SizeBits:1216] map[Name:i_ordered OffsetBits:12224 SizeBits:128] map[Name:i_hash_cache OffsetBits:12352 SizeBits:64] map[Name:i_entries OffsetBits:12416 SizeBits:32] map[Name:i_diskflags OffsetBits:12448 SizeBits:32] map[Name:i_height OffsetBits:12480 SizeBits:8] map[Name:i_depth OffsetBits:12488 SizeBits:8] map[Name:i_rahead OffsetBits:12496 SizeBits:16]]]
|
| 48/2 |
2026/05/24 08:20 |
llm |
expert |
0m
Model:
Tokens:
input: 104189
output: 17
thoughts: 1473
Thoughts: **Analyzing the `gfs2` Inode Lock Corruption**
Okay, let's break this down. The crash report points to an offset of 304 bytes, which, after mapping the bits to bytes and matching with relevant structure offsets, turns out to be precisely within the `i_rwsem.wait_list` of a `struct gfs2_inode`. This is a read-write semaphore's wait list, and it's initialized during inode allocation via `inode_init_always_gfp`. The core issue is that this list is being corrupted β it's being reinitialized, essentially making it empty, when it shouldn't be. This suggests the underlying `rwsem` in `struct inode` is being reinitialized at the worst possible time.
My initial thought was that the `dentry` or even the inode itself was being freed and reallocated while the task, likely inside `chown_common`, held a reference. I went through all the standard refcounting possibilities:
* The dentry couldn't be freed because `chown_common` clearly has a path (`path.dentry`) that holds a reference.
* The dentry being replaced by an "old" dentry seems unlikely, especially given my knowledge of how VFS handles dentries.
* I considered a custom `d_revalidate` function in `gfs2` that might unhash the dentry, but the crash would manifest differently if that were the case.
Then, I shifted my focus to the lock itself. Could the task in `chown_common` be killed by a signal (e.g., SIGKILL) while blocked in `inode_lock_killable`? If that were the case, the function should return `-EINTR`. However, the crash happens inside the `rwsem_try_write_lock`, which is a function that *attempts* to acquire the lock. This strongly suggests that the lock was, in fact, acquired, which would be impossible if the task had been killed and the function had returned.
Let's consider that `rwsem_try_write_lock` implies acquisition on success. The reinitialization of the `rwsem` would reset the `count`, which makes the lock look unlocked. A task waiting on the lock would wake up (or be spinning), see it as unlocked, acquire it, and attempt to remove itself from the waiter list. This is where the crash occurs; the list has been reinitialized to empty. This is the smoking gun!
So, the critical sequence is this:
1. Task A calls `chown_common` and blocks in `inode_lock_killable`.
2. Crucially, the `inode` is freed and reallocated. This is the root cause.
3. The reallocation triggers `init_rwsem`, which resets the `i_rwsem.count` to indicate an unlocked state and sets the `wait_list` to be empty.
4. Task A, after an indeterminate amount of time, awakes or starts spinning and perceives that the lock is unlocked, so it acquires it.
5. It calls `list_del(&waiter->list)` and crashes because the `wait_list` is empty.
The only question now is: How is the inode freed while Task A is holding a reference via the path (`path.dentry`) in `chown_common`? The reference count (`i_count`) of the inode should prevent it from being freed. If `i_count` is > 0, `iput` will not call `iput_final`, and the inode will not be evicted. Therefore, the problem has to be with an incorrect decrement of the inode's reference count. I need to investigate any `iput` calls within the `gfs2` filesystem to look for a possible reference count imbalance.
|
| 49/2 |
2026/05/24 08:20 |
tool |
grepper |
0m
Args:
Results: map[Output:
Full output is too long, showing 500 out of 4593 lines.
Use more precise expression if possible.
[Documentation/filesystems/porting.rst=338=of those. Caller makes sure async writeback cannot be running for the inode while
--
Documentation/filesystems/porting.rst-340-
Documentation/filesystems/porting.rst:341:->drop_inode() returns int now; it's called on final iput() with
Documentation/filesystems/porting.rst-342-inode->i_lock held and it returns true if filesystems wants the inode to be
--
Documentation/filesystems/porting.rst=354=NOTE: checking i_nlink in the beginning of ->write_inode() and bailing out
Documentation/filesystems/porting.rst:355:if it's zero is not *and* *never* *had* *been* enough. Final unlink() and iput()
Documentation/filesystems/porting.rst-356-may happen while the inode is in the middle of ->write_inode(); e.g. if you blindly
--
Documentation/filesystems/porting.rst=1112=of the in-tree instances did), use your own spinlock.
Documentation/filesystems/porting.rst-1113-
Documentation/filesystems/porting.rst:1114:->d_iput() and ->d_release() are called with victim dentry still in the
Documentation/filesystems/porting.rst-1115-list of parent's children. It is still unhashed, marked killed, etc., just not
--
Documentation/filesystems/vfs.rst=1201=defined:
--
Documentation/filesystems/vfs.rst-1304- deallocated). The default when this is NULL is that the VFS
Documentation/filesystems/vfs.rst:1305: calls iput(). If you define this method, you must call iput()
Documentation/filesystems/vfs.rst-1306- yourself
--
Documentation/filesystems/vfs.rst=1411=manipulate dentries:
--
Documentation/filesystems/vfs.rst-1432- dentry then the dentry is turned into a negative dentry (the
Documentation/filesystems/vfs.rst:1433: d_iput() method is called). If there are other references, then
Documentation/filesystems/vfs.rst-1434- d_drop() is called instead
--
arch/powerpc/platforms/cell/spufs/inode.c=218=spufs_mkdir(struct inode *dir, struct dentry *dentry, unsigned int flags,
--
arch/powerpc/platforms/cell/spufs/inode.c-232- if (!ctx) {
arch/powerpc/platforms/cell/spufs/inode.c:233: iput(inode);
arch/powerpc/platforms/cell/spufs/inode.c-234- return -ENOSPC;
--
arch/powerpc/platforms/cell/spufs/inode.c=445=spufs_mkgang(struct inode *dir, struct dentry *dentry, umode_t mode)
--
arch/powerpc/platforms/cell/spufs/inode.c-474-out_iput:
arch/powerpc/platforms/cell/spufs/inode.c:475: iput(inode);
arch/powerpc/platforms/cell/spufs/inode.c-476-out:
--
arch/s390/kernel/uv.c=296=int s390_wiggle_split_folio(struct mm_struct *mm, struct folio *folio)
--
arch/s390/kernel/uv.c-363- filemap_write_and_wait_range(mapping, lstart, lend);
arch/s390/kernel/uv.c:364: iput(mapping->host);
arch/s390/kernel/uv.c-365- }
--
block/bdev.c=472=struct block_device *bdev_alloc(struct gendisk *disk, u8 partno)
--
block/bdev.c-495- if (!bdev->bd_stats) {
block/bdev.c:496: iput(inode);
block/bdev.c-497- return NULL;
--
block/bdev.c=527=void bdev_drop(struct block_device *bdev)
block/bdev.c-528-{
block/bdev.c:529: iput(BD_INODE(bdev));
block/bdev.c-530-}
--
block/bdev.c=834=struct block_device *blkdev_get_no_open(dev_t dev, bool autoload)
--
block/bdev.c-853- bdev = NULL;
block/bdev.c:854: iput(inode);
block/bdev.c-855- return bdev;
--
block/bdev.c=1274=void sync_bdevs(bool wait)
--
block/bdev.c-1299- */
block/bdev.c:1300: iput(old_inode);
block/bdev.c-1301- old_inode = inode;
--
block/bdev.c-1322- spin_unlock(&blockdev_superblock->s_inode_list_lock);
block/bdev.c:1323: iput(old_inode);
block/bdev.c-1324-}
--
drivers/android/binder/rust_binderfs.c=114=static int binderfs_binder_device_create(struct inode *ref_inode,
--
drivers/android/binder/rust_binderfs.c-201- mutex_unlock(&binderfs_minors_mutex);
drivers/android/binder/rust_binderfs.c:202: iput(inode);
drivers/android/binder/rust_binderfs.c-203-
--
drivers/android/binder/rust_binderfs.c=376=static int binderfs_binder_ctl_create(struct super_block *sb)
--
drivers/android/binder/rust_binderfs.c-434- kfree(device);
drivers/android/binder/rust_binderfs.c:435: iput(inode);
drivers/android/binder/rust_binderfs.c-436-
--
drivers/android/binder/rust_binderfs.c=464=static struct dentry *rust_binderfs_create_file(struct dentry *parent, const char *name,
--
drivers/android/binder/rust_binderfs.c-478- if (IS_ERR(dentry)) {
drivers/android/binder/rust_binderfs.c:479: iput(new_inode);
drivers/android/binder/rust_binderfs.c-480- return dentry;
--
drivers/android/binder/rust_binderfs.c=503=static struct dentry *binderfs_create_dir(struct dentry *parent,
--
drivers/android/binder/rust_binderfs.c-517- if (IS_ERR(dentry)) {
drivers/android/binder/rust_binderfs.c:518: iput(new_inode);
drivers/android/binder/rust_binderfs.c-519- return dentry;
--
drivers/android/binderfs.c=114=static int binderfs_binder_device_create(struct inode *ref_inode,
--
drivers/android/binderfs.c-206- mutex_unlock(&binderfs_minors_mutex);
drivers/android/binderfs.c:207: iput(inode);
drivers/android/binderfs.c-208-
--
drivers/android/binderfs.c=385=static int binderfs_binder_ctl_create(struct super_block *sb)
--
drivers/android/binderfs.c-444- kfree(device);
drivers/android/binderfs.c:445: iput(inode);
drivers/android/binderfs.c-446-
--
drivers/dax/super.c=379=static void dax_destroy_inode(struct inode *inode)
--
drivers/dax/super.c-382- WARN_ONCE(test_bit(DAXDEV_ALIVE, &dax_dev->flags),
drivers/dax/super.c:383: "kill_dax() must be called before final iput()\n");
drivers/dax/super.c-384-}
--
drivers/dax/super.c=484=void put_dax(struct dax_device *dax_dev)
--
drivers/dax/super.c-487- return;
drivers/dax/super.c:488: iput(&dax_dev->inode);
drivers/dax/super.c-489-}
--
drivers/dma-buf/dma-buf.c=627=static struct file *dma_buf_getfile(size_t size, int flags)
--
drivers/dma-buf/dma-buf.c-654-err_alloc_file:
drivers/dma-buf/dma-buf.c:655: iput(inode);
drivers/dma-buf/dma-buf.c-656- return file;
--
drivers/gpu/drm/drm_drv.c=600=EXPORT_SYMBOL(drm_dev_wedged_event);
--
drivers/gpu/drm/drm_drv.c-610- * The drm_fs_inode_new() function allocates a new inode, drm_fs_inode_free()
drivers/gpu/drm/drm_drv.c:611: * frees it again. You are allowed to use iget() and iput() to get references to
drivers/gpu/drm/drm_drv.c-612- * the inode. But each drm_fs_inode_new() call must be paired with exactly one
drivers/gpu/drm/drm_drv.c:613: * drm_fs_inode_free() call (which does not have to be the last iput()).
drivers/gpu/drm/drm_drv.c-614- * We use drm_fs_inode_*() to manage our internal VFS mount-point and share it
--
drivers/gpu/drm/drm_drv.c-616- * iget() + drm_fs_inode_free() directly after alloc and sometime later do an
drivers/gpu/drm/drm_drv.c:617: * iput(), but this way you'd end up with a new vfsmount for each inode.
drivers/gpu/drm/drm_drv.c-618- */
--
drivers/gpu/drm/drm_drv.c=653=static void drm_fs_inode_free(struct inode *inode)
--
drivers/gpu/drm/drm_drv.c-655- if (inode) {
drivers/gpu/drm/drm_drv.c:656: iput(inode);
drivers/gpu/drm/drm_drv.c-657- simple_release_fs(&drm_fs_mnt, &drm_fs_cnt);
--
drivers/infiniband/core/uverbs_cmd.c=571=static void xrcd_table_delete(struct ib_uverbs_device *dev,
--
drivers/infiniband/core/uverbs_cmd.c-577- if (entry) {
drivers/infiniband/core/uverbs_cmd.c:578: iput(inode);
drivers/infiniband/core/uverbs_cmd.c-579- rb_erase(&entry->node, &dev->xrcd_tree);
--
drivers/usb/gadget/function/f_fs.c=1883=static int ffs_sb_create_file(struct super_block *sb, const char *name,
--
drivers/usb/gadget/function/f_fs.c-1894- if (IS_ERR(dentry)) {
drivers/usb/gadget/function/f_fs.c:1895: iput(inode);
drivers/usb/gadget/function/f_fs.c-1896- return PTR_ERR(dentry);
--
drivers/usb/gadget/legacy/inode.c=1986=static int gadgetfs_create_file (struct super_block *sb, char const *name,
--
drivers/usb/gadget/legacy/inode.c-1998- if (IS_ERR(dentry)) {
drivers/usb/gadget/legacy/inode.c:1999: iput(inode);
drivers/usb/gadget/legacy/inode.c-2000- return PTR_ERR(dentry);
--
drivers/vfio/vfio_main.c=187=static void vfio_device_release(struct device *dev)
--
drivers/vfio/vfio_main.c-197-
drivers/vfio/vfio_main.c:198: iput(device->inode);
drivers/vfio/vfio_main.c-199- simple_release_fs(&vfio.vfs_mount, &vfio.fs_count);
--
drivers/vfio/vfio_main.c=273=static int vfio_init_device(struct vfio_device *device, struct device *dev,
--
drivers/vfio/vfio_main.c-306-out_uninit:
drivers/vfio/vfio_main.c:307: iput(device->inode);
drivers/vfio/vfio_main.c-308- simple_release_fs(&vfio.vfs_mount, &vfio.fs_count);
--
fs/affs/amigaffs.c=142=affs_remove_link(struct dentry *dentry)
--
fs/affs/amigaffs.c-193- affs_unlock_dir(dir);
fs/affs/amigaffs.c:194: iput(dir);
fs/affs/amigaffs.c-195- } else {
--
fs/affs/inode.c=291=affs_new_inode(struct inode *dir)
--
fs/affs/inode.c-336-err_block:
fs/affs/inode.c:337: iput(inode);
fs/affs/inode.c-338-err_inode:
--
fs/affs/namei.c=245=affs_create(struct mnt_idmap *idmap, struct inode *dir,
--
fs/affs/namei.c-269- clear_nlink(inode);
fs/affs/namei.c:270: iput(inode);
fs/affs/namei.c-271- return error;
--
fs/affs/namei.c=277=affs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
--
fs/affs/namei.c-299- mark_inode_dirty(inode);
fs/affs/namei.c:300: iput(inode);
fs/affs/namei.c-301- return ERR_PTR(error);
--
fs/affs/namei.c=316=affs_symlink(struct mnt_idmap *idmap, struct inode *dir,
--
fs/affs/namei.c-388- mark_inode_dirty(inode);
fs/affs/namei.c:389: iput(inode);
fs/affs/namei.c-390- return error;
--
fs/afs/dir.c=28=static int afs_d_delete(const struct dentry *dentry);
fs/afs/dir.c:29:static void afs_d_iput(struct dentry *dentry, struct inode *inode);
fs/afs/dir.c-30-static bool afs_lookup_one_filldir(struct dir_context *ctx, const char *name, int nlen,
--
fs/afs/dir.c=1184=static int afs_d_delete(const struct dentry *dentry)
--
fs/afs/dir.c-1206- */
fs/afs/dir.c:1207:static void afs_d_iput(struct dentry *dentry, struct inode *inode)
fs/afs/dir.c-1208-{
fs/afs/dir.c-1209- if (dentry->d_flags & DCACHE_NFSFS_RENAMED)
fs/afs/dir.c:1210: afs_silly_iput(dentry, inode);
fs/afs/dir.c:1211: iput(inode);
fs/afs/dir.c-1212-}
--
fs/afs/dir_silly.c=111=int afs_sillyrename(struct afs_vnode *dvnode, struct afs_vnode *vnode,
--
fs/afs/dir_silly.c-159-
fs/afs/dir_silly.c:160: iput(&vnode->netfs.inode);
fs/afs/dir_silly.c-161- dput(sdentry);
--
fs/afs/dir_silly.c=201=static int afs_do_silly_unlink(struct afs_vnode *dvnode, struct afs_vnode *vnode,
--
fs/afs/dir_silly.c-243- */
fs/afs/dir_silly.c:244:int afs_silly_iput(struct dentry *dentry, struct inode *inode)
fs/afs/dir_silly.c-245-{
--
fs/afs/fs_operation.c=329=int afs_put_operation(struct afs_operation *op)
--
fs/afs/fs_operation.c-342- if (op->file[0].put_vnode)
fs/afs/fs_operation.c:343: iput(&op->file[0].vnode->netfs.inode);
fs/afs/fs_operation.c-344- if (op->file[1].put_vnode)
fs/afs/fs_operation.c:345: iput(&op->file[1].vnode->netfs.inode);
fs/afs/fs_operation.c-346-
--
fs/afs/fs_operation.c-349- if (op->more_files[i].put_vnode)
fs/afs/fs_operation.c:350: iput(&op->more_files[i].vnode->netfs.inode);
fs/afs/fs_operation.c-351- kfree(op->more_files);
--
fs/afs/internal.h=1134=extern int afs_sillyrename(struct afs_vnode *, struct afs_vnode *,
fs/afs/internal.h-1135- struct dentry *, struct key *);
fs/afs/internal.h:1136:extern int afs_silly_iput(struct dentry *, struct inode *);
fs/afs/internal.h-1137-
--
fs/aio.c=260=static struct file *aio_private_file(struct kioctx *ctx, loff_t nr_pages)
--
fs/aio.c-273- if (IS_ERR(file))
fs/aio.c:274: iput(inode);
fs/aio.c-275- return file;
--
fs/anon_inodes.c=113=struct inode *anon_inode_make_secure_inode(struct super_block *sb, const char *name,
--
fs/anon_inodes.c-126- if (error) {
fs/anon_inodes.c:127: iput(inode);
fs/anon_inodes.c-128- return ERR_PTR(error);
--
fs/anon_inodes.c=134=static struct file *__anon_inode_getfile(const char *name,
--
fs/anon_inodes.c-177-err_iput:
fs/anon_inodes.c:178: iput(inode);
fs/anon_inodes.c-179-err:
--
fs/bad_inode.c=245=void iget_failed(struct inode *inode)
--
fs/bad_inode.c-248- unlock_new_inode(inode);
fs/bad_inode.c:249: iput(inode);
fs/bad_inode.c-250-}
--
fs/bfs/dir.c=78=static int bfs_create(struct mnt_idmap *idmap, struct inode *dir,
--
fs/bfs/dir.c-93- mutex_unlock(&info->bfs_lock);
fs/bfs/dir.c:94: iput(inode);
fs/bfs/dir.c-95- return -ENOSPC;
--
fs/bfs/dir.c-116- mutex_unlock(&info->bfs_lock);
fs/bfs/dir.c:117: iput(inode);
fs/bfs/dir.c-118- return err;
--
fs/btrfs/block-group.c=3308=static int cache_save_setup(struct btrfs_block_group *block_group,
--
fs/btrfs/block-group.c-3456-out_put:
fs/btrfs/block-group.c:3457: iput(inode);
fs/btrfs/block-group.c-3458-out_free:
--
fs/btrfs/block-group.c=4553=void btrfs_put_block_group_cache(struct btrfs_fs_info *info)
--
fs/btrfs/block-group.c-4568- ASSERT(block_group->io_ctl.inode == NULL);
fs/btrfs/block-group.c:4569: iput(&inode->vfs_inode);
fs/btrfs/block-group.c-4570- } else {
--
fs/btrfs/btrfs_inode.h=620=int btrfs_cont_expand(struct btrfs_inode *inode, loff_t oldsize, loff_t size);
fs/btrfs/btrfs_inode.h:621:void btrfs_add_delayed_iput(struct btrfs_inode *inode);
fs/btrfs/btrfs_inode.h-622-void btrfs_run_delayed_iputs(struct btrfs_fs_info *fs_info);
--
fs/btrfs/defrag.c=215=static int btrfs_run_defrag_inode(struct btrfs_fs_info *fs_info,
--
fs/btrfs/defrag.c-245- if (cur >= i_size_read(&inode->vfs_inode)) {
fs/btrfs/defrag.c:246: iput(&inode->vfs_inode);
fs/btrfs/defrag.c-247- goto cleanup;
--
fs/btrfs/defrag.c-260- defrag->transid, BTRFS_DEFRAG_BATCH);
fs/btrfs/defrag.c:261: iput(&inode->vfs_inode);
fs/btrfs/defrag.c-262-
--
fs/btrfs/disk-io.c=3293=int __cold open_ctree(struct super_block *sb, struct btrfs_fs_devices *fs_devices)
--
fs/btrfs/disk-io.c-3730-
fs/btrfs/disk-io.c:3731: iput(fs_info->btree_inode);
fs/btrfs/disk-io.c-3732-fail:
--
fs/btrfs/disk-io.c=4240=void __cold close_ctree(struct btrfs_fs_info *fs_info)
--
fs/btrfs/disk-io.c-4388- * shrink_delalloc() -> btrfs_start_delalloc_roots() ->
fs/btrfs/disk-io.c:4389: * start_delalloc_inodes() -> btrfs_add_delayed_iput()
fs/btrfs/disk-io.c-4390- */
--
fs/btrfs/disk-io.c-4482-
fs/btrfs/disk-io.c:4483: iput(fs_info->btree_inode);
fs/btrfs/disk-io.c-4484-
--
fs/btrfs/disk-io.c=4632=static void btrfs_destroy_delalloc_inodes(struct btrfs_root *root)
--
fs/btrfs/disk-io.c-4657- memalloc_nofs_restore(nofs_flag);
fs/btrfs/disk-io.c:4658: iput(inode);
fs/btrfs/disk-io.c-4659- }
--
fs/btrfs/disk-io.c=4744=static void btrfs_cleanup_bg_io(struct btrfs_block_group *cache)
--
fs/btrfs/disk-io.c-4757- cache->io_ctl.inode = NULL;
fs/btrfs/disk-io.c:4758: iput(inode);
fs/btrfs/disk-io.c-4759- }
--
fs/btrfs/export.c=79=struct dentry *btrfs_get_dentry(struct super_block *sb, u64 objectid,
--
fs/btrfs/export.c-98- if (generation != 0 && generation != inode->vfs_inode.i_generation) {
fs/btrfs/export.c:99: iput(&inode->vfs_inode);
fs/btrfs/export.c-100- return ERR_PTR(-ESTALE);
--
fs/btrfs/extent_io.c=2455=static int extent_write_cache_pages(struct address_space *mapping,
--
fs/btrfs/extent_io.c-2617-
fs/btrfs/extent_io.c:2618: btrfs_add_delayed_iput(BTRFS_I(inode));
fs/btrfs/extent_io.c-2619- return ret;
--
fs/btrfs/extent_map.c=1256=static long btrfs_scan_root(struct btrfs_root *root, struct btrfs_em_shrink_ctx *ctx)
--
fs/btrfs/extent_map.c-1269- fs_info->em_shrinker_last_ino = btrfs_ino(inode);
fs/btrfs/extent_map.c:1270: iput(&inode->vfs_inode);
fs/btrfs/extent_map.c-1271-
--
fs/btrfs/free-space-cache.c=244=int btrfs_remove_free_space_inode(struct btrfs_trans_handle *trans,
--
fs/btrfs/free-space-cache.c-264- if (ret) {
fs/btrfs/free-space-cache.c:265: btrfs_add_delayed_iput(BTRFS_I(inode));
fs/btrfs/free-space-cache.c-266- return ret;
--
fs/btrfs/free-space-cache.c-273- spin_unlock(&block_group->lock);
fs/btrfs/free-space-cache.c:274: iput(inode);
fs/btrfs/free-space-cache.c-275- } else {
--
fs/btrfs/free-space-cache.c-278- /* One for the lookup ref */
fs/btrfs/free-space-cache.c:279: btrfs_add_delayed_iput(BTRFS_I(inode));
fs/btrfs/free-space-cache.c-280-
--
fs/btrfs/free-space-cache.c=940=int load_free_space_cache(struct btrfs_block_group *block_group)
--
fs/btrfs/free-space-cache.c-1064- spin_unlock(&ctl->tree_lock);
fs/btrfs/free-space-cache.c:1065: iput(inode);
fs/btrfs/free-space-cache.c-1066- return ret;
--
fs/btrfs/free-space-cache.c=1289=static int __btrfs_wait_cache_io(struct btrfs_root *root,
--
fs/btrfs/free-space-cache.c-1339- io_ctl->inode = NULL;
fs/btrfs/free-space-cache.c:1340: iput(inode);
fs/btrfs/free-space-cache.c-1341- }
--
fs/btrfs/free-space-cache.c=1369=static int __btrfs_write_out_cache(struct inode *inode,
--
fs/btrfs/free-space-cache.c-1509- if (must_iput)
fs/btrfs/free-space-cache.c:1510: iput(inode);
fs/btrfs/free-space-cache.c-1511- return ret;
--
fs/btrfs/free-space-cache.c=1514=int btrfs_write_out_cache(struct btrfs_trans_handle *trans,
--
fs/btrfs/free-space-cache.c-1543- block_group->io_ctl.inode = NULL;
fs/btrfs/free-space-cache.c:1544: iput(inode);
fs/btrfs/free-space-cache.c-1545- }
--
fs/btrfs/inode.c=1657=static noinline void submit_compressed_extents(struct btrfs_work *work, bool do_free)
--
fs/btrfs/inode.c-1668-
fs/btrfs/inode.c:1669: btrfs_add_delayed_iput(async_chunk->inode);
fs/btrfs/inode.c-1670- if (async_chunk->blkcg_css)
--
fs/btrfs/inode.c=2851=static void btrfs_writepage_fixup_worker(struct btrfs_work *work)
--
fs/btrfs/inode.c-2972- */
fs/btrfs/inode.c:2973: btrfs_add_delayed_iput(inode);
fs/btrfs/inode.c-2974-}
--
fs/btrfs/inode.c=3538=bool btrfs_data_csum_ok(struct btrfs_bio *bbio, struct btrfs_device *dev,
--
fs/btrfs/inode.c-3589- */
fs/btrfs/inode.c:3590:void btrfs_add_delayed_iput(struct btrfs_inode *inode)
fs/btrfs/inode.c-3591-{
--
fs/btrfs/inode.c=3613=static void run_delayed_iput_locked(struct btrfs_fs_info *fs_info,
--
fs/btrfs/inode.c-3617- spin_unlock_irq(&fs_info->delayed_iput_lock);
fs/btrfs/inode.c:3618: iput(&inode->vfs_inode);
fs/btrfs/inode.c-3619- if (atomic_dec_and_test(&fs_info->nr_delayed_iputs))
--
fs/btrfs/inode.c-3623-
fs/btrfs/inode.c:3624:static void btrfs_run_delayed_iput(struct btrfs_fs_info *fs_info,
fs/btrfs/inode.c-3625- struct btrfs_inode *inode)
--
fs/btrfs/inode.c=3635=void btrfs_run_delayed_iputs(struct btrfs_fs_info *fs_info)
--
fs/btrfs/inode.c-3638- * btrfs_put_ordered_extent() can run in irq context (see bio.c), which
fs/btrfs/inode.c:3639: * calls btrfs_add_delayed_iput() and that needs to lock
fs/btrfs/inode.c-3640- * fs_info->delayed_iput_lock. So we need to disable irqs here to
--
fs/btrfs/inode.c=3712=int btrfs_orphan_cleanup(struct btrfs_root *root)
--
fs/btrfs/inode.c-3777- * not able to remove its items via eviction triggered
fs/btrfs/inode.c:3778: * by an iput(). A transaction abort may have happened,
fs/btrfs/inode.c-3779- * due to -ENOSPC for example, so try to grab the error
--
fs/btrfs/inode.c-3864- ret = btrfs_drop_verity_items(inode);
fs/btrfs/inode.c:3865: iput(&inode->vfs_inode);
fs/btrfs/inode.c-3866- inode = NULL;
--
fs/btrfs/inode.c-3887- /* this will do delete_inode and everything for us */
fs/btrfs/inode.c:3888: iput(&inode->vfs_inode);
fs/btrfs/inode.c-3889- }
--
fs/btrfs/inode.c=4405=static int __btrfs_unlink_inode(struct btrfs_trans_handle *trans,
--
fs/btrfs/inode.c-4493- */
fs/btrfs/inode.c:4494: btrfs_run_delayed_iput(fs_info, inode);
fs/btrfs/inode.c-4495-
--
fs/btrfs/inode.c=4739=static void btrfs_prune_dentries(struct btrfs_root *root)
--
fs/btrfs/inode.c-4757- */
fs/btrfs/inode.c:4758: iput(&inode->vfs_inode);
fs/btrfs/inode.c-4759- cond_resched();
--
fs/btrfs/inode.c=6062=struct inode *btrfs_lookup_dentry(struct inode *dir, struct dentry *dentry)
--
fs/btrfs/inode.c-6089- di_type);
fs/btrfs/inode.c:6090: iput(&inode->vfs_inode);
fs/btrfs/inode.c-6091- return ERR_PTR(-EUCLEAN);
--
fs/btrfs/inode.c-6114- if (ret) {
fs/btrfs/inode.c:6115: iput(&inode->vfs_inode);
fs/btrfs/inode.c-6116- inode = ERR_PTR(ret);
--
fs/btrfs/inode.c=6609=int btrfs_create_new_inode(struct btrfs_trans_handle *trans,
--
fs/btrfs/inode.c-6817- parent);
fs/btrfs/inode.c:6818: iput(&parent->vfs_inode);
fs/btrfs/inode.c-6819- }
--
fs/btrfs/inode.c-6872- /*
fs/btrfs/inode.c:6873: * discard_new_inode() calls iput(), but the caller owns the reference
fs/btrfs/inode.c-6874- * to the inode.
--
fs/btrfs/inode.c=6963=static int btrfs_create_common(struct inode *dir, struct dentry *dentry,
--
fs/btrfs/inode.c-6999- if (ret)
fs/btrfs/inode.c:7000: iput(inode);
fs/btrfs/inode.c-7001- return ret;
--
fs/btrfs/inode.c=8561=static int btrfs_rename(struct mnt_idmap *idmap,
--
fs/btrfs/inode.c-8815- unlock_new_inode(whiteout_args.inode);
fs/btrfs/inode.c:8816: iput(whiteout_args.inode);
fs/btrfs/inode.c-8817- whiteout_args.inode = NULL;
--
fs/btrfs/inode.c-8833- if (flags & RENAME_WHITEOUT)
fs/btrfs/inode.c:8834: iput(whiteout_args.inode);
fs/btrfs/inode.c-8835-out_fscrypt_names:
--
fs/btrfs/inode.c=8869=static void btrfs_run_delalloc_work(struct btrfs_work *work)
--
fs/btrfs/inode.c-8881-
fs/btrfs/inode.c:8882: iput(inode);
fs/btrfs/inode.c-8883- complete(&delalloc_work->completion);
--
fs/btrfs/inode.c=8906=static int start_delalloc_inodes(struct btrfs_root *root, long *nr_to_write,
--
fs/btrfs/inode.c-8940- if (!work) {
fs/btrfs/inode.c:8941: iput(tmp_inode);
fs/btrfs/inode.c-8942- ret = -ENOMEM;
--
fs/btrfs/inode.c-8950- nr_to_write);
]
]
|
| 50/2 |
2026/05/24 08:20 |
llm |
expert |
0m
Model:
Tokens:
input: 116429
output: 43
thoughts: 810
Thoughts: **Analyzing Potential GFS2 Inode Freeing Issues**
Okay, so `gfs2_drop_inode` is called when `i_count` hits zero. That's the key. If it returns 1, the inode gets evicted. My initial thought was that a reference was being held somewhere it shouldn't be during a `chown_common` operation, leading to a race where the inode could be freed prematurely. The issue is that `chown_common` does hold a reference, specifically when calling `inode_lock_killable`.
I thought maybe `chown_common` was somehow waiting on the `i_rwsem` of a *different* inode. Looking at the code confirms it locks the inode pointed to by `path->dentry->d_inode`. If that pointer somehow changed between the `chown_common` was called, and the inode lock was called, then it could be a race condition. But, `path->dentry` *should* hold a reference to that `d_inode`. If the dentry refcounting is broken, then that would be a VFS issue. So I started thinking it was not a bug with GFS2, and likely a bug in the VFS. However, the bug report specifies the slab is the `gfs2_inode`, so it's a specific `gfs2` issue.
So, why would *GFS2* have this problem? My mind immediately goes to operations that could potentially involve swapping inodes. And that brings up `gfs2_rename`... no, wait, `gfs2_exchange` is the one that swaps inodes. So I need to dig into `gfs2_exchange`. That's where I need to focus my attention.
|
| 51/2 |
2026/05/24 08:21 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:fs/gfs2/inode.c IncludeLines:true Name:gfs2_exchange]
Results: map[SourceCode:1736: static int gfs2_exchange(struct inode *odir, struct dentry *odentry,
1737: struct inode *ndir, struct dentry *ndentry,
1738: unsigned int flags)
1739: {
1740: struct gfs2_inode *odip = GFS2_I(odir);
1741: struct gfs2_inode *ndip = GFS2_I(ndir);
1742: struct gfs2_inode *oip = GFS2_I(odentry->d_inode);
1743: struct gfs2_inode *nip = GFS2_I(ndentry->d_inode);
1744: struct gfs2_sbd *sdp = GFS2_SB(odir);
1745: struct gfs2_holder ghs[4], r_gh;
1746: unsigned int num_gh;
1747: unsigned int retries = 0, x;
1748: umode_t old_mode = oip->i_inode.i_mode;
1749: umode_t new_mode = nip->i_inode.i_mode;
1750: int error;
1751:
1752: gfs2_holder_mark_uninitialized(&r_gh);
1753: error = gfs2_rindex_update(sdp);
1754: if (error)
1755: return error;
1756:
1757: if (odip != ndip) {
1758: error = gfs2_glock_nq_init(sdp->sd_rename_gl, LM_ST_EXCLUSIVE,
1759: 0, &r_gh);
1760: if (error)
1761: goto out;
1762:
1763: if (S_ISDIR(old_mode)) {
1764: /* don't move a directory into its subdir */
1765: error = gfs2_ok_to_move(oip, ndip);
1766: if (error)
1767: goto out_gunlock_r;
1768: }
1769:
1770: if (S_ISDIR(new_mode)) {
1771: /* don't move a directory into its subdir */
1772: error = gfs2_ok_to_move(nip, odip);
1773: if (error)
1774: goto out_gunlock_r;
1775: }
1776: }
1777:
1778: num_gh = 1;
1779: gfs2_holder_init(odip->i_gl, LM_ST_EXCLUSIVE, GL_ASYNC, ghs);
1780: if (odip != ndip) {
1781: gfs2_holder_init(ndip->i_gl, LM_ST_EXCLUSIVE, GL_ASYNC,
1782: ghs + num_gh);
1783: num_gh++;
1784: }
1785: gfs2_holder_init(oip->i_gl, LM_ST_EXCLUSIVE, GL_ASYNC, ghs + num_gh);
1786: num_gh++;
1787:
1788: gfs2_holder_init(nip->i_gl, LM_ST_EXCLUSIVE, GL_ASYNC, ghs + num_gh);
1789: num_gh++;
1790:
1791: again:
1792: for (x = 0; x < num_gh; x++) {
1793: error = gfs2_glock_nq(ghs + x);
1794: if (error)
1795: goto out_gunlock;
1796: }
1797:
1798: error = gfs2_glock_async_wait(num_gh, ghs, retries);
1799: if (error == -ESTALE) {
1800: retries++;
1801: goto again;
1802: }
1803: if (error)
1804: goto out_gunlock;
1805:
1806: error = -ENOENT;
1807: if (oip->i_inode.i_nlink == 0 || nip->i_inode.i_nlink == 0)
1808: goto out_gunlock;
1809:
1810: error = gfs2_unlink_ok(odip, &odentry->d_name, oip);
1811: if (error)
1812: goto out_gunlock;
1813: error = gfs2_unlink_ok(ndip, &ndentry->d_name, nip);
1814: if (error)
1815: goto out_gunlock;
1816:
1817: if (S_ISDIR(old_mode)) {
1818: error = gfs2_permission(&nop_mnt_idmap, odentry->d_inode,
1819: MAY_WRITE);
1820: if (error)
1821: goto out_gunlock;
1822: }
1823: if (S_ISDIR(new_mode)) {
1824: error = gfs2_permission(&nop_mnt_idmap, ndentry->d_inode,
1825: MAY_WRITE);
1826: if (error)
1827: goto out_gunlock;
1828: }
1829: error = gfs2_trans_begin(sdp, 4 * RES_DINODE + 4 * RES_LEAF, 0);
1830: if (error)
1831: goto out_gunlock;
1832:
1833: error = update_moved_ino(oip, ndip, S_ISDIR(old_mode));
1834: if (error)
1835: goto out_end_trans;
1836:
1837: error = update_moved_ino(nip, odip, S_ISDIR(new_mode));
1838: if (error)
1839: goto out_end_trans;
1840:
1841: error = gfs2_dir_mvino(ndip, &ndentry->d_name, oip,
1842: IF2DT(old_mode));
1843: if (error)
1844: goto out_end_trans;
1845:
1846: error = gfs2_dir_mvino(odip, &odentry->d_name, nip,
1847: IF2DT(new_mode));
1848: if (error)
1849: goto out_end_trans;
1850:
1851: if (odip != ndip) {
1852: if (S_ISDIR(new_mode) && !S_ISDIR(old_mode)) {
1853: inc_nlink(&odip->i_inode);
1854: drop_nlink(&ndip->i_inode);
1855: } else if (S_ISDIR(old_mode) && !S_ISDIR(new_mode)) {
1856: inc_nlink(&ndip->i_inode);
1857: drop_nlink(&odip->i_inode);
1858: }
1859: }
1860: mark_inode_dirty(&ndip->i_inode);
1861: if (odip != ndip)
1862: mark_inode_dirty(&odip->i_inode);
1863:
1864: out_end_trans:
1865: gfs2_trans_end(sdp);
1866: out_gunlock:
1867: while (x--) {
1868: if (gfs2_holder_queued(ghs + x))
1869: gfs2_glock_dq(ghs + x);
1870: gfs2_holder_uninit(ghs + x);
1871: }
1872: out_gunlock_r:
1873: if (gfs2_holder_initialized(&r_gh))
1874: gfs2_glock_dq_uninit(&r_gh);
1875: out:
1876: return error;
1877: }
SourceFile:fs/gfs2/inode.c]
|
| 52/2 |
2026/05/24 08:21 |
llm |
expert |
0m
Model:
Tokens:
input: 119999
output: 19
thoughts: 4732
Thoughts: **Deep Dive into a Potential Inode Use-After-Free in GFS2**
Okay, so I'm digging into a crash related to `chown_common` and a potential use-after-free scenario within the GFS2 file system. The core of the problem appears to be a corruption in an `rwsem` (read-write semaphore) used to protect inode access. The stack trace leads me to `rwsem_down_write_slowpath` and a `list_del` call, and the reported error indicates the `sem->wait_list` is corrupted - appearing to be empty while a waiting "waiter" is still pointing into the list.
My initial thought was that a direct call to `clear_inode` or `iput` on an in-use inode in GFS2 might be the culprit. I went through the evict inode logic (`gfs2_evict_inode`), but the direct calls weren't happening. I followed the code path through `gfs2_rename`, and whiteout inodes, but these were correct.
I then started to focus on the `gfs2_create_inode` path and the `free_inode_nonrcu` function. This seemed suspicious, but the newly created inode is safe and it's not the cause. The problem isn't the free function itself, but the *reallocation* and reinitialization of the inode.
The critical observation here is that `inode_init_always_gfp` is called when the inode is allocated from the slab, which calls `init_rwsem` *again* on an inode. This reinitializes the semaphore, which seems to be the key to the corruption.
So, here's the scenario I believe is happening:
1. A task (like `chown_common`) is waiting on an `inode->i_rwsem` to become available for a write lock.
2. The inode is somehow freed to the slab cache *while* it's in the wait state.
3. The inode is then reallocated. At this point, the `i_rwsem` within the reallocated inode is reinitialized!
4. The waiting task (now with a stale pointer to the freed inode) wakes up.
5. It attempts to acquire the write lock, but the reinitialization corrupted the semaphore (or the old waiter), and the `list_del` in `rwsem_try_write_lock` crashes because the list is in an unexpected state.
The question then is, how can an inode be freed *while* it is actively in use by a `chown_common` operation? `chown_common` receives a `path` which has a reference to both the dentry and the inode via `user_path_at`. This means VFS should prevent freeing the inode. The GFS2 implementation doesn't call `kmem_cache_free` on the inode directly. This should protect it.
Could the dentry become invalid? The checks on `gfs2_drevalidate` didn't indicate invalid dentry problems. So the `path` should always be valid. And it can't be null because the crash occurs at a valid address.
So, the next thing I looked at was the semaphore internals. If a task is interrupted by a signal, the `waiter` is removed from the wait list, even if it hasn't acquired the lock. This seems correct. But the `list_del` itself crashes, so it seems like the problem is a data race or a corruption of the semaphore's internal state.
The key is in the `list_del` failing because `sem->wait_list` is empty. So, `INIT_LIST_HEAD(&sem->wait_list)` or `init_rwsem` *has* to be called while there are waiters! And this can only happen when the inode is reallocated, which leads to `init_rwsem` being called again! So, there is a race condition. The key is understanding how a task can be in the wait queue, and then the inode be reallocated, which results in the list being reset.
I still have a very deep suspicion that I am missing something. I need to be more mindful of how the inode is allocated and freed. The core of the problem lies with that `init_rwsem` and when it's reinitialized. This points to a classic use-after-free issue, and the challenge is tracking down the exact sequence of events that triggers the race condition: GFS2 frees an inode (that a waiter is on), but another task is on it so VFS doesn't release it; it waits, and then the inode is reallocated.
|
| 53/2 |
2026/05/24 08:21 |
tool |
codesearch-struct-layout |
0m
Args:
Results: map[Fields:[map[Name:i_mode OffsetBits:0 SizeBits:16] map[Name:i_opflags OffsetBits:16 SizeBits:16] map[Name:i_flags OffsetBits:32 SizeBits:32] map[Name:i_acl OffsetBits:64 SizeBits:64] map[Name:i_default_acl OffsetBits:128 SizeBits:64] map[Name:i_uid OffsetBits:192 SizeBits:32] map[Name:i_gid OffsetBits:224 SizeBits:32] map[Name:i_op OffsetBits:256 SizeBits:64] map[Name:i_sb OffsetBits:320 SizeBits:64] map[Name:i_mapping OffsetBits:384 SizeBits:64] map[Name:i_security OffsetBits:448 SizeBits:64] map[Name:i_ino OffsetBits:512 SizeBits:64] map[Name: OffsetBits:576 SizeBits:32] map[Name:i_rdev OffsetBits:608 SizeBits:32] map[Name:i_size OffsetBits:640 SizeBits:64] map[Name:i_atime_sec OffsetBits:704 SizeBits:64] map[Name:i_mtime_sec OffsetBits:768 SizeBits:64] map[Name:i_ctime_sec OffsetBits:832 SizeBits:64] map[Name:i_atime_nsec OffsetBits:896 SizeBits:32] map[Name:i_mtime_nsec OffsetBits:928 SizeBits:32] map[Name:i_ctime_nsec OffsetBits:960 SizeBits:32] map[Name:i_generation OffsetBits:992 SizeBits:32] map[Name:i_lock OffsetBits:1024 SizeBits:512] map[Name:i_bytes OffsetBits:1536 SizeBits:16] map[Name:i_blkbits OffsetBits:1552 SizeBits:8] map[Name:i_write_hint OffsetBits:1560 SizeBits:8] map[Name:i_blocks OffsetBits:1600 SizeBits:64] map[Name:i_state OffsetBits:1664 SizeBits:32] map[Name:i_rwsem OffsetBits:1728 SizeBits:1216] map[Name:dirtied_when OffsetBits:2944 SizeBits:64] map[Name:dirtied_time_when OffsetBits:3008 SizeBits:64] map[Name:i_hash OffsetBits:3072 SizeBits:128] map[Name:i_io_list OffsetBits:3200 SizeBits:128] map[Name:i_wb OffsetBits:3328 SizeBits:64] map[Name:i_wb_frn_winner OffsetBits:3392 SizeBits:32] map[Name:i_wb_frn_avg_time OffsetBits:3424 SizeBits:16] map[Name:i_wb_frn_history OffsetBits:3440 SizeBits:16] map[Name:i_lru OffsetBits:3456 SizeBits:128] map[Name:i_sb_list OffsetBits:3584 SizeBits:128] map[Name:i_wb_list OffsetBits:3712 SizeBits:128] map[Name: OffsetBits:3840 SizeBits:128] map[Name:i_version OffsetBits:3968 SizeBits:64] map[Name:i_sequence OffsetBits:4032 SizeBits:64] map[Name:i_count OffsetBits:4096 SizeBits:32] map[Name:i_dio_count OffsetBits:4128 SizeBits:32] map[Name:i_writecount OffsetBits:4160 SizeBits:32] map[Name:i_readcount OffsetBits:4192 SizeBits:32] map[Name: OffsetBits:4224 SizeBits:64] map[Name:i_flctx OffsetBits:4288 SizeBits:64] map[Name:i_data OffsetBits:4352 SizeBits:4416] map[Name: OffsetBits:8768 SizeBits:128] map[Name: OffsetBits:8896 SizeBits:64] map[Name:i_fsnotify_mask OffsetBits:8960 SizeBits:32] map[Name:i_fsnotify_marks OffsetBits:9024 SizeBits:64] map[Name:i_private OffsetBits:9088 SizeBits:64]]]
|
| 54/2 |
2026/05/24 08:21 |
llm |
expert |
0m
Model:
Tokens:
input: 127014
output: 23
thoughts: 2119
Thoughts: **The Mystery of the Reallocated Inode**
Okay, so I'm staring at this crash dump, and it's throwing me for a loop. The key lies in this `i_rwsem` field within the inode structure. I see that the crash points to a specific address related to `sem->wait_list`, and the value there is *exactly* what `INIT_LIST_HEAD` would produce. This is a dead giveaway: `init_rwsem` was called on this semaphore. Since `init_rwsem` gets called during inode initialization, this means the inode was reallocated.
But here's the kicker: the `chown_common` function *should* be holding a reference to this inode! It retrieves the inode via `user_path_at` (a chain of calls including `user_path_at_empty`, `filename_lookup`, and `path_lookupat`), which in turn calls `path_lookupat` and *should* increment the reference count on the dentry and by extension the inode. The path, and thus the dentry, *should* keep the inode alive. I've checked and rechecked that call path: `user_path_at` definitely holds a reference. Even if it's a symlink, or a device node, the dentry is still refcounted.
I've been double-checking the code for potential reference-dropping bugs within `gfs2`'s `gfs2_permission` and `gfs2_setattr` and it seems the lock functions don't drop the inode reference. Memory pressure also is not the problem since the VFS handles the `i_count` which must be 0 for an inode to be removed by memory management and I'm sure the `chown_common` function holds a reference. What about scenarios where the inode is allocated but `d_instantiate` never called and it gets freed? That's not the case here because `chown_common` is getting the inode through the `path->dentry->d_inode` which means that the `d_instantiate` function must have been called. Even a detached dentry still holds a reference. And if we're dealing with a file descriptor, that too implies a dentry reference that cannot be dropped. The `user_path_at` function cannot return without holding the refcount. It seems that there is no situation where `user_path_at` returns without holding a reference.
Then I considered the possibility of a race: Perhaps `chown_common` acquires the lock, but before it can release the lock (or while it holds the lock), something triggers a reallocation. If the task gets killed within the `inode_lock_killable` calls to `down_write_killable` then the lock should not be acquired, and the `rwsem_try_write_lock` call in the crash could not be possible. But the crash *is* in `rwsem_try_write_lock`, which means the lock *was* acquired! If it's acquired, that implies it was unlocked and reinitialized! So the inode must have been reallocated. How could the inode have been freed while `chown_common` holds a reference? The `i_count` *must* have gone to zero! That's a paradox!
Could there be *another* call to `init_rwsem` that is reinitializing the semaphore? I examined the gfs2 inode initialization and that's not possible. The `inode_init_always_gfp` function *should* always be called when the inode is allocated, it is *not* called when the inode is already in the cache. And that function *always* calls `init_rwsem`. There's no way `gfs2` is overwriting the semaphore of *another* inode, as that function operates on the *newly* allocated inode. And, just to be sure, `chown_common` is definitely operating on the inode attached to the dentry, not some stray `inode` pointer. There's no way the inode is a dangling pointer, because the `path` holds a reference to it. And no "fake" dentry either. And a lazy unmount of the filesystem *shouldn't* drop the superblock or the inodes.
I'm now back to the core mystery: How can an inode be reallocated (and thus, its `i_rwsem` reinitialized) *while* `chown_common` ostensibly holds a reference to it? I'm going to have to carefully re-examine *every* single line of code in that refcounting path, looking for a subtle flaw, a missed assumption, or some interaction with `gfs2` that I'm overlooking.
|
| 55/2 |
2026/05/24 08:22 |
tool |
grepper |
0m
Args: map[Expression:init_rwsem.*i_rwsem]
Results: map[Output:fs/inode.c=228=int inode_init_always_gfp(struct super_block *sb, struct inode *inode, gfp_t gfp)
--
fs/inode.c-272-
fs/inode.c:273: init_rwsem(&inode->i_rwsem);
fs/inode.c-274- lockdep_set_class(&inode->i_rwsem, &sb->s_type->i_mutex_key);
--
fs/inode.c=1193=void lockdep_annotate_inode_mutex_key(struct inode *inode)
--
fs/inode.c-1202- */
fs/inode.c:1203: init_rwsem(&inode->i_rwsem);
fs/inode.c-1204- lockdep_set_class(&inode->i_rwsem,
]
|
| 56/2 |
2026/05/24 08:22 |
llm |
expert |
0m
Model:
Tokens:
input: 130398
output: 44
thoughts: 54
Thoughts: Here's my take on the thought process, as requested:
**Annotating the Inode Mutex in Lockdep**
Okay, so I'm digging into how `lockdep` handles mutex annotations, and I've just noticed something interesting: `lockdep_annotate_inode_mutex_key` makes a call to `init_rwsem(&inode->i_rwsem)`. That jumps out immediately. I know `init_rwsem` initializes a read-write semaphore. This suggests that the inode's read-write semaphore is critical here. And it's being set up in conjunction with `lockdep`'s annotation. Hmm, that's important.
To understand this better, I need to see what `lockdep_annotate_inode_mutex_key` is *actually* doing. I'll need to go directly to the source code for that. I'm going to jump into `fs/inode.c` and have a look at the implementation of `lockdep_annotate_inode_mutex_key` and see how it interacts with the semaphore initialization. I'll need to see how the mutex key is set up, what conditions trigger this call, and how it relates to the inode's locking strategy. Understanding the relationship between the semaphore and the mutex key is going to be key to grasping this piece of the kernel's locking behavior.
|
| 57/2 |
2026/05/24 08:22 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:fs/inode.c IncludeLines:true Name:lockdep_annotate_inode_mutex_key]
Results: map[SourceCode:1193: void lockdep_annotate_inode_mutex_key(struct inode *inode)
1194: {
1195: if (S_ISDIR(inode->i_mode)) {
1196: struct file_system_type *type = inode->i_sb->s_type;
1197:
1198: /* Set new key only if filesystem hasn't already changed it */
1199: if (lockdep_match_class(&inode->i_rwsem, &type->i_mutex_key)) {
1200: /*
1201: * ensure nobody is actually holding i_rwsem
1202: */
1203: init_rwsem(&inode->i_rwsem);
1204: lockdep_set_class(&inode->i_rwsem,
1205: &type->i_mutex_dir_key);
1206: }
1207: }
1208: }
SourceFile:fs/inode.c]
|
| 58/2 |
2026/05/24 08:22 |
llm |
expert |
0m
Model:
Tokens:
input: 131071
output: 34
thoughts: 102
Thoughts: **Deep Dive into Inode Locking**
Wow, okay, so `lockdep_annotate_inode_mutex_key` is calling `init_rwsem` on `inode->i_rwsem`! That's interesting, and it seems like it's happening specifically when an inode is being instantiated as a directory, which I wouldn't have necessarily expected at first glance. I need to understand the implications of that.
Right, so who's actually *calling* `lockdep_annotate_inode_mutex_key`? Let's trace that call. Ah, it looks like it's called by `d_instantiate` and `unlock_new_inode`. Okay, so those are the key functions in inode initialization and cleanup. That makes sense. I'll need to remember those entry points. Now I'm going to dig deeper and look at the contexts in which these are being called.
|
| 59/2 |
2026/05/24 08:22 |
tool |
codesearch-find-references |
0m
Args: map[IncludeSnippetLines:0 Name:lockdep_annotate_inode_mutex_key]
Results: map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__shmem_get_inode SourceFile:mm/shmem.c SourceLine:3142] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:d_instantiate_new SourceFile:fs/dcache.c SourceLine:2029] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:discard_new_inode SourceFile:fs/inode.c SourceLine:1232] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:hugetlbfs_get_inode SourceFile:fs/hugetlbfs/inode.c SourceLine:975] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:hugetlbfs_get_root SourceFile:fs/hugetlbfs/inode.c SourceLine:912] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:unlock_new_inode SourceFile:fs/inode.c SourceLine:1221]] TruncatedOutput:false]
|
| 60/2 |
2026/05/24 08:22 |
llm |
expert |
0m
Model:
Tokens:
input: 131727
output: 45
thoughts: 202
Thoughts: **Investigating a Potential Lockdep Violation**
Okay, wait a second... this is concerning. I'm looking at `unlock_new_inode`, and it's calling `lockdep_annotate_inode_mutex_key`. That function, in turn, initializes the read-write semaphore `i_rwsem` on the inode, specifically using `init_rwsem(&inode->i_rwsem)` if the inode is a directory! But `unlock_new_inode` *should* only be called once, right? When a *newly created* inode is ready, and *before* it gets exposed to other tasks.
Here's the problem: if something is *waiting* on that `i_rwsem`, that *absolutely* implies the inode has already been made available to other tasks. If it hasn't, no one could possibly be waiting on the semaphore. So, how in the world is `unlock_new_inode` being called on an inode that's already visible and potentially being accessed concurrently? This feels like a blatant violation of the intended locking rules. I need to track down how this is even possible. I'm going to look at the calling code, specifically, let's examine `gfs2_create_inode` and see if I can find the source of the problem.
|
| 61/2 |
2026/05/24 08:22 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:fs/gfs2/inode.c IncludeLines:true Name:gfs2_create_inode]
Results: map[SourceCode: 700: static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
701: struct file *file,
702: umode_t mode, dev_t dev, const char *symname,
703: unsigned int size, int excl)
704: {
705: const struct qstr *name = &dentry->d_name;
706: struct posix_acl *default_acl, *acl;
707: struct gfs2_holder d_gh, gh;
708: struct inode *inode = NULL;
709: struct gfs2_inode *dip = GFS2_I(dir), *ip;
710: struct gfs2_sbd *sdp = GFS2_SB(&dip->i_inode);
711: struct gfs2_glock *io_gl;
712: int error, dealloc_error;
713: u32 aflags = 0;
714: unsigned blocks = 1;
715: struct gfs2_diradd da = { .bh = NULL, .save_loc = 1, };
716: bool xattr_initialized = false;
717:
718: if (!name->len || name->len > GFS2_FNAMESIZE)
719: return -ENAMETOOLONG;
720:
721: error = gfs2_qa_get(dip);
722: if (error)
723: return error;
724:
725: error = gfs2_rindex_update(sdp);
726: if (error)
727: goto fail;
728:
729: error = gfs2_glock_nq_init(dip->i_gl, LM_ST_EXCLUSIVE, 0, &d_gh);
730: if (error)
731: goto fail;
732: gfs2_holder_mark_uninitialized(&gh);
733:
734: error = create_ok(dip, name, mode);
735: if (error)
736: goto fail_gunlock;
737:
738: inode = gfs2_dir_search(dir, &dentry->d_name, !S_ISREG(mode) || excl);
739: error = PTR_ERR(inode);
740: if (!IS_ERR(inode)) {
741: if (S_ISDIR(inode->i_mode)) {
742: iput(inode);
743: inode = NULL;
744: error = -EISDIR;
745: goto fail_gunlock;
746: }
747: d_instantiate(dentry, inode);
748: error = 0;
749: if (file) {
750: if (S_ISREG(inode->i_mode))
751: error = finish_open(file, dentry, gfs2_open_common);
752: else
753: error = finish_no_open(file, NULL);
754: }
755: gfs2_glock_dq_uninit(&d_gh);
756: goto fail;
757: } else if (error != -ENOENT) {
758: goto fail_gunlock;
759: }
760:
761: error = gfs2_diradd_alloc_required(dir, name, &da);
762: if (error < 0)
763: goto fail_gunlock;
764:
765: inode = new_inode(sdp->sd_vfs);
766: error = -ENOMEM;
767: if (!inode)
768: goto fail_gunlock;
769: gfs2_setup_inode(inode);
770: ip = GFS2_I(inode);
771:
772: error = posix_acl_create(dir, &mode, &default_acl, &acl);
773: if (error)
774: goto fail_gunlock;
775:
776: error = gfs2_qa_get(ip);
777: if (error)
778: goto fail_free_acls;
779:
780: inode->i_mode = mode;
781: set_nlink(inode, S_ISDIR(mode) ? 2 : 1);
782: inode->i_rdev = dev;
783: inode->i_size = size;
784: simple_inode_init_ts(inode);
785: munge_mode_uid_gid(dip, inode);
786: check_and_update_goal(dip);
787: ip->i_goal = dip->i_goal;
788: ip->i_diskflags = 0;
789: ip->i_eattr = 0;
790: ip->i_height = 0;
791: ip->i_depth = 0;
792: ip->i_entries = 0;
793: ip->i_no_addr = 0; /* Temporarily zero until real addr is assigned */
794:
795: switch(mode & S_IFMT) {
796: case S_IFREG:
797: if ((dip->i_diskflags & GFS2_DIF_INHERIT_JDATA) ||
798: gfs2_tune_get(sdp, gt_new_files_jdata))
799: ip->i_diskflags |= GFS2_DIF_JDATA;
800: gfs2_set_aops(inode);
801: break;
802: case S_IFDIR:
803: ip->i_diskflags |= (dip->i_diskflags & GFS2_DIF_INHERIT_JDATA);
804: ip->i_diskflags |= GFS2_DIF_JDATA;
805: ip->i_entries = 2;
806: break;
807: }
808:
809: /* Force SYSTEM flag on all files and subdirs of a SYSTEM directory */
810: if (dip->i_diskflags & GFS2_DIF_SYSTEM)
811: ip->i_diskflags |= GFS2_DIF_SYSTEM;
812:
813: gfs2_set_inode_flags(inode);
814:
815: if ((GFS2_I(d_inode(sdp->sd_root_dir)) == dip) ||
816: (dip->i_diskflags & GFS2_DIF_TOPDIR))
817: aflags |= GFS2_AF_ORLOV;
818:
819: if (default_acl || acl)
820: blocks++;
821:
822: error = alloc_dinode(ip, aflags, &blocks);
823: if (error)
824: goto fail_free_inode;
825:
826: gfs2_set_inode_blocks(inode, blocks);
827:
828: error = gfs2_glock_get(sdp, ip->i_no_addr, &gfs2_inode_glops, CREATE, &ip->i_gl);
829: if (error)
830: goto fail_dealloc_inode;
831:
832: error = gfs2_glock_get(sdp, ip->i_no_addr, &gfs2_iopen_glops, CREATE, &io_gl);
833: if (error)
834: goto fail_dealloc_inode;
835: gfs2_cancel_delete_work(io_gl);
836: io_gl->gl_no_formal_ino = ip->i_no_formal_ino;
837:
838: retry:
839: error = insert_inode_locked4(inode, ip->i_no_addr, iget_test, &ip->i_no_addr);
840: if (error == -EBUSY)
841: goto retry;
842: if (error)
843: goto fail_gunlock2;
844:
845: error = gfs2_glock_nq_init(io_gl, LM_ST_SHARED, GL_EXACT | GL_NOPID,
846: &ip->i_iopen_gh);
847: if (error)
848: goto fail_gunlock2;
849:
850: error = gfs2_glock_nq_init(ip->i_gl, LM_ST_EXCLUSIVE, GL_SKIP, &gh);
851: if (error)
852: goto fail_gunlock3;
853: clear_bit(GLF_INSTANTIATE_NEEDED, &ip->i_gl->gl_flags);
854:
855: error = gfs2_trans_begin(sdp, blocks, 0);
856: if (error)
857: goto fail_gunlock3;
858:
859: if (blocks > 1) {
860: gfs2_init_xattr(ip);
861: xattr_initialized = true;
862: }
863: init_dinode(dip, ip, symname);
864: gfs2_trans_end(sdp);
865:
866: glock_set_object(ip->i_gl, ip);
867: glock_set_object(io_gl, ip);
868: gfs2_set_iop(inode);
869:
870: if (default_acl) {
871: error = __gfs2_set_acl(inode, default_acl, ACL_TYPE_DEFAULT);
872: if (error)
873: goto fail_gunlock4;
874: posix_acl_release(default_acl);
875: default_acl = NULL;
876: }
877: if (acl) {
878: error = __gfs2_set_acl(inode, acl, ACL_TYPE_ACCESS);
879: if (error)
880: goto fail_gunlock4;
881: posix_acl_release(acl);
882: acl = NULL;
883: }
884:
885: error = security_inode_init_security(&ip->i_inode, &dip->i_inode, name,
886: &gfs2_initxattrs, NULL);
887: if (error)
888: goto fail_gunlock4;
889:
890: error = link_dinode(dip, name, ip, &da);
891: if (error)
892: goto fail_gunlock4;
893:
894: mark_inode_dirty(inode);
895: d_instantiate(dentry, inode);
896: /* After instantiate, errors should result in evict which will destroy
897: * both inode and iopen glocks properly. */
898: if (file) {
899: file->f_mode |= FMODE_CREATED;
900: error = finish_open(file, dentry, gfs2_open_common);
901: }
902: gfs2_glock_dq_uninit(&d_gh);
903: gfs2_qa_put(ip);
904: gfs2_glock_dq_uninit(&gh);
905: gfs2_glock_put(io_gl);
906: gfs2_qa_put(dip);
907: unlock_new_inode(inode);
908: return error;
909:
910: fail_gunlock4:
911: glock_clear_object(ip->i_gl, ip);
912: glock_clear_object(io_gl, ip);
913: fail_gunlock3:
914: gfs2_glock_dq_uninit(&ip->i_iopen_gh);
915: fail_gunlock2:
916: gfs2_glock_put(io_gl);
917: fail_dealloc_inode:
918: dealloc_error = 0;
919: if (ip->i_eattr)
920: dealloc_error = gfs2_ea_dealloc(ip, xattr_initialized);
921: clear_nlink(inode);
922: mark_inode_dirty(inode);
923: if (!dealloc_error)
924: dealloc_error = gfs2_dinode_dealloc(ip);
925: if (dealloc_error)
926: fs_warn(sdp, "%s: %d\n", __func__, dealloc_error);
927: ip->i_no_addr = 0;
928: fail_free_inode:
929: if (ip->i_gl) {
930: gfs2_glock_put(ip->i_gl);
931: ip->i_gl = NULL;
932: }
933: gfs2_rs_deltree(&ip->i_res);
934: gfs2_qa_put(ip);
935: fail_free_acls:
936: posix_acl_release(default_acl);
937: posix_acl_release(acl);
938: fail_gunlock:
939: gfs2_dir_no_add(&da);
940: gfs2_glock_dq_uninit(&d_gh);
941: if (!IS_ERR_OR_NULL(inode)) {
942: if (inode_state_read_once(inode) & I_NEW)
943: iget_failed(inode);
944: else
945: iput(inode);
946: }
947: if (gfs2_holder_initialized(&gh))
948: gfs2_glock_dq_uninit(&gh);
949: fail:
950: gfs2_qa_put(dip);
951: return error;
952: }
SourceFile:fs/gfs2/inode.c]
|
| 62/2 |
2026/05/24 08:22 |
llm |
expert |
0m
Model:
Tokens:
input: 136405
output: 31
thoughts: 1575
Thoughts: **The Race Condition in GFS2 Inode Creation**
Okay, here's what's happening. I've been tracing the execution of `gfs2_create_inode` and it's calling `d_instantiate` to expose a new inode *before* calling `unlock_new_inode`. This immediately flags a potential issue because `d_instantiate` makes the inode visible in the VFS. This is where things get tricky, because of how `i_rwsem` is handled.
The initial thought was a deadlock, that chown might block on i_rwsem, held by the create process, but that's not it. It's actually worse: Because the inode is considered "new", it's initialized without locking `i_rwsem`. So, another task (like a `chown` process), can acquire it immediately. Then, the process creating the inode eventually *re*initializes `i_rwsem` in `unlock_new_inode`βspecifically, *if* the inode is a directory. The `init_rwsem` call clears the wait list on `i_rwsem`. So, if `chown` is blocking, waiting on `i_rwsem`, it's wait queue gets corrupted, and when `chown` gets the lock and attempts to manipulate the wait queue, it crashes.
The key is the order: `d_instantiate` *before* `unlock_new_inode`. This exposes the inode *before* the critical `init_rwsem` is called. The comment in the kernel code even says to ensure nobody is holding the lock. And it's doing precisely the opposite.
I can confirm this by examining the code. The sequence is clear: `d_instantiate` is followed by operations that can be time-consuming, like `finish_open`, `gfs2_glock_dq_uninit`. During this time, the dentry is visible. Another task can then perform a `chown`.
Since `gfs2_create_inode` doesn't hold `i_rwsem`, multiple tasks can call `chown` concurrently. This means that if one `chown` process acquires `i_rwsem` and another `chown` process blocks, waiting on the semaphore, and then `unlock_new_inode` executes and calls `init_rwsem` to reset the wait queue, this will corrupt the `wait_list` of the second task. The second task resumes, attempts to release the corrupt list, and crashes.
This isn't an esoteric edge case. A user can easily trigger this: creating a directory (using `mkdir`, which, I verified, calls `gfs2_create_inode`) and concurrently running `chown` or `chmod` on that directory. This race condition is a direct result of the code exposing the inode prematurely.
|
| 63/2 |
2026/05/24 08:22 |
tool |
codesearch-find-references |
0m
Args: map[IncludeSnippetLines:0 Name:gfs2_create_inode]
Results: map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:gfs2_atomic_open SourceFile:fs/gfs2/inode.c SourceLine:1402] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:gfs2_create SourceFile:fs/gfs2/inode.c SourceLine:968] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:gfs2_mkdir SourceFile:fs/gfs2/inode.c SourceLine:1352] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:gfs2_mknod SourceFile:fs/gfs2/inode.c SourceLine:1368] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:gfs2_symlink SourceFile:fs/gfs2/inode.c SourceLine:1334]] TruncatedOutput:false]
|
| 64/2 |
2026/05/24 08:22 |
llm |
expert |
0m
Model:
Tokens:
input: 138906
output: 28
thoughts: 2721
Thoughts: **Analysis of Potential Kernel Bug in GFS2 Filesystem**
Okay, so it looks like `gfs2_mkdir` calls `gfs2_create_inode`, which is where the problem starts. An unprivileged user can trigger this locally with a loop of `mkdir` and `chown`, leading to a local denial of service (DoS) β specifically, a kernel `BUG()`. I'm concerned about whether this is exploitable for privilege escalation. The root cause appears to be a `list_del` corruption.
The `list_del` corruption will trigger a kernel `BUG()` in `__list_del_entry_valid_or_report` if `CONFIG_DEBUG_LIST` is enabled, which the crash report seems to confirm. If `CONFIG_DEBUG_LIST` is *not* enabled, the `list_del` would normally just perform a simple pointer manipulation, re-initializing the list to empty if the waiter was the only one. Harmless in that case, or if the waiter was in the middle of a multi-waiter list. However, if the `list_del` happens on an outdated list, we see that the next task is essentially removed from the wait list. This is also relatively harmless.
My concern is memory corruption. The critical point is if the stack frame of a waiter is destroyed while its list entry still exists, then its list is going to point to freed memory, leading to an obvious crash. It's not immediately clear how an attacker could directly control pointers in this context, as they're just stack addresses or inode-related addresses, preventing an arbitrary write. The attacker can't seem to control the addresses, which would be the key to exploiting.
However, kernel security best practices mean list corruptions are generally considered potentially exploitable. Prompt says "Memory safety issues are almost always exploitable (KASAN or UBSAN reports for use-after-free, out-of-bounds; refcounting issues, corrupted lists, etc)". So it's looking like this is actually *exploitable*.
Can this be triggered by an unprivileged user? Yes, definitely. Anyone with write access to a GFS2 filesystem directory can trigger it via `mkdir` and `chown`.
Does it apply to unprivileged users? If they have write access on an already-mounted GFS2 filesystem they can trigger it.
Is this accessible from a user namespace? Yes, if they can mount it there, but GFS2 is not `FS_USERNS_MOUNT`, so they can't.
Is this a filesystem trigger? The prompt distinguishes a regular filesystem operation from a malicious filesystem. This is triggered by normal operations on a legitimate GFS2 filesystem, therefore it is not a "Filesystem Trigger".
It is NOT a network, remote, peripheral, VM guest, or VM host trigger.
The bug is a race condition between `gfs2_create_inode` and any VFS operation that locks the inode, like `chown`, `chmod`, etc. The fix is to call `unlock_new_inode(inode)` before `d_instantiate(dentry, inode)`. It seems my analysis is sound, and I should check if this was fixed in the kernel.
|
| 65/2 |
2026/05/24 08:23 |
tool |
grepper |
0m
Error:
Args: map[Expression:unlock_new_inode.*d_instantiate.*gfs2]
Results:
|
| 66/2 |
2026/05/24 08:23 |
llm |
expert |
0m
Model:
Tokens:
input: 142351
output: 45
thoughts: 18
Thoughts: Here's my attempt at summarizing the thought process, tailored for an expert audience:
**Diving into `gfs2_create_inode` in the Current Kernel**
Okay, time to pull up the latest kernel sources and zero in on `gfs2_create_inode`. I need to refresh my memory on the inode creation path in GFS2, especially with any recent changes. I'm thinking about potential issues that might be popping up or performance bottlenecks that could have been introduced, or perhaps optimized. Iβll start by tracing the function, identifying its entry point and arguments; things like `inode` and `parent`, obviously, but I want to double-check what else is being passed in, as these arguments determine the context and constraints of the function. Iβll make sure to note any locks involved, and in what order, to guard against race conditions or deadlocks. I need to be particularly mindful of any interactions with the disk format, block allocation, or metadata updates within the transaction context. Iβm also going to see how `gfs2_create_inode` interacts with the different file system operations like, `mkdir`, `create`, `mknod`, or symlinks.
Ultimately, I'm trying to get a complete picture of this part of the codebase to gain a deeper understanding of the system, and better prepare for future troubleshooting and optimization tasks.
|
| 67/2 |
2026/05/24 08:23 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:fs/gfs2/inode.c IncludeLines:true Name:gfs2_create_inode]
Results: map[SourceCode: 700: static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
701: struct file *file,
702: umode_t mode, dev_t dev, const char *symname,
703: unsigned int size, int excl)
704: {
705: const struct qstr *name = &dentry->d_name;
706: struct posix_acl *default_acl, *acl;
707: struct gfs2_holder d_gh, gh;
708: struct inode *inode = NULL;
709: struct gfs2_inode *dip = GFS2_I(dir), *ip;
710: struct gfs2_sbd *sdp = GFS2_SB(&dip->i_inode);
711: struct gfs2_glock *io_gl;
712: int error, dealloc_error;
713: u32 aflags = 0;
714: unsigned blocks = 1;
715: struct gfs2_diradd da = { .bh = NULL, .save_loc = 1, };
716: bool xattr_initialized = false;
717:
718: if (!name->len || name->len > GFS2_FNAMESIZE)
719: return -ENAMETOOLONG;
720:
721: error = gfs2_qa_get(dip);
722: if (error)
723: return error;
724:
725: error = gfs2_rindex_update(sdp);
726: if (error)
727: goto fail;
728:
729: error = gfs2_glock_nq_init(dip->i_gl, LM_ST_EXCLUSIVE, 0, &d_gh);
730: if (error)
731: goto fail;
732: gfs2_holder_mark_uninitialized(&gh);
733:
734: error = create_ok(dip, name, mode);
735: if (error)
736: goto fail_gunlock;
737:
738: inode = gfs2_dir_search(dir, &dentry->d_name, !S_ISREG(mode) || excl);
739: error = PTR_ERR(inode);
740: if (!IS_ERR(inode)) {
741: if (S_ISDIR(inode->i_mode)) {
742: iput(inode);
743: inode = NULL;
744: error = -EISDIR;
745: goto fail_gunlock;
746: }
747: d_instantiate(dentry, inode);
748: error = 0;
749: if (file) {
750: if (S_ISREG(inode->i_mode))
751: error = finish_open(file, dentry, gfs2_open_common);
752: else
753: error = finish_no_open(file, NULL);
754: }
755: gfs2_glock_dq_uninit(&d_gh);
756: goto fail;
757: } else if (error != -ENOENT) {
758: goto fail_gunlock;
759: }
760:
761: error = gfs2_diradd_alloc_required(dir, name, &da);
762: if (error < 0)
763: goto fail_gunlock;
764:
765: inode = new_inode(sdp->sd_vfs);
766: error = -ENOMEM;
767: if (!inode)
768: goto fail_gunlock;
769: gfs2_setup_inode(inode);
770: ip = GFS2_I(inode);
771:
772: error = posix_acl_create(dir, &mode, &default_acl, &acl);
773: if (error)
774: goto fail_gunlock;
775:
776: error = gfs2_qa_get(ip);
777: if (error)
778: goto fail_free_acls;
779:
780: inode->i_mode = mode;
781: set_nlink(inode, S_ISDIR(mode) ? 2 : 1);
782: inode->i_rdev = dev;
783: inode->i_size = size;
784: simple_inode_init_ts(inode);
785: munge_mode_uid_gid(dip, inode);
786: check_and_update_goal(dip);
787: ip->i_goal = dip->i_goal;
788: ip->i_diskflags = 0;
789: ip->i_eattr = 0;
790: ip->i_height = 0;
791: ip->i_depth = 0;
792: ip->i_entries = 0;
793: ip->i_no_addr = 0; /* Temporarily zero until real addr is assigned */
794:
795: switch(mode & S_IFMT) {
796: case S_IFREG:
797: if ((dip->i_diskflags & GFS2_DIF_INHERIT_JDATA) ||
798: gfs2_tune_get(sdp, gt_new_files_jdata))
799: ip->i_diskflags |= GFS2_DIF_JDATA;
800: gfs2_set_aops(inode);
801: break;
802: case S_IFDIR:
803: ip->i_diskflags |= (dip->i_diskflags & GFS2_DIF_INHERIT_JDATA);
804: ip->i_diskflags |= GFS2_DIF_JDATA;
805: ip->i_entries = 2;
806: break;
807: }
808:
809: /* Force SYSTEM flag on all files and subdirs of a SYSTEM directory */
810: if (dip->i_diskflags & GFS2_DIF_SYSTEM)
811: ip->i_diskflags |= GFS2_DIF_SYSTEM;
812:
813: gfs2_set_inode_flags(inode);
814:
815: if ((GFS2_I(d_inode(sdp->sd_root_dir)) == dip) ||
816: (dip->i_diskflags & GFS2_DIF_TOPDIR))
817: aflags |= GFS2_AF_ORLOV;
818:
819: if (default_acl || acl)
820: blocks++;
821:
822: error = alloc_dinode(ip, aflags, &blocks);
823: if (error)
824: goto fail_free_inode;
825:
826: gfs2_set_inode_blocks(inode, blocks);
827:
828: error = gfs2_glock_get(sdp, ip->i_no_addr, &gfs2_inode_glops, CREATE, &ip->i_gl);
829: if (error)
830: goto fail_dealloc_inode;
831:
832: error = gfs2_glock_get(sdp, ip->i_no_addr, &gfs2_iopen_glops, CREATE, &io_gl);
833: if (error)
834: goto fail_dealloc_inode;
835: gfs2_cancel_delete_work(io_gl);
836: io_gl->gl_no_formal_ino = ip->i_no_formal_ino;
837:
838: retry:
839: error = insert_inode_locked4(inode, ip->i_no_addr, iget_test, &ip->i_no_addr);
840: if (error == -EBUSY)
841: goto retry;
842: if (error)
843: goto fail_gunlock2;
844:
845: error = gfs2_glock_nq_init(io_gl, LM_ST_SHARED, GL_EXACT | GL_NOPID,
846: &ip->i_iopen_gh);
847: if (error)
848: goto fail_gunlock2;
849:
850: error = gfs2_glock_nq_init(ip->i_gl, LM_ST_EXCLUSIVE, GL_SKIP, &gh);
851: if (error)
852: goto fail_gunlock3;
853: clear_bit(GLF_INSTANTIATE_NEEDED, &ip->i_gl->gl_flags);
854:
855: error = gfs2_trans_begin(sdp, blocks, 0);
856: if (error)
857: goto fail_gunlock3;
858:
859: if (blocks > 1) {
860: gfs2_init_xattr(ip);
861: xattr_initialized = true;
862: }
863: init_dinode(dip, ip, symname);
864: gfs2_trans_end(sdp);
865:
866: glock_set_object(ip->i_gl, ip);
867: glock_set_object(io_gl, ip);
868: gfs2_set_iop(inode);
869:
870: if (default_acl) {
871: error = __gfs2_set_acl(inode, default_acl, ACL_TYPE_DEFAULT);
872: if (error)
873: goto fail_gunlock4;
874: posix_acl_release(default_acl);
875: default_acl = NULL;
876: }
877: if (acl) {
878: error = __gfs2_set_acl(inode, acl, ACL_TYPE_ACCESS);
879: if (error)
880: goto fail_gunlock4;
881: posix_acl_release(acl);
882: acl = NULL;
883: }
884:
885: error = security_inode_init_security(&ip->i_inode, &dip->i_inode, name,
886: &gfs2_initxattrs, NULL);
887: if (error)
888: goto fail_gunlock4;
889:
890: error = link_dinode(dip, name, ip, &da);
891: if (error)
892: goto fail_gunlock4;
893:
894: mark_inode_dirty(inode);
895: d_instantiate(dentry, inode);
896: /* After instantiate, errors should result in evict which will destroy
897: * both inode and iopen glocks properly. */
898: if (file) {
899: file->f_mode |= FMODE_CREATED;
900: error = finish_open(file, dentry, gfs2_open_common);
901: }
902: gfs2_glock_dq_uninit(&d_gh);
903: gfs2_qa_put(ip);
904: gfs2_glock_dq_uninit(&gh);
905: gfs2_glock_put(io_gl);
906: gfs2_qa_put(dip);
907: unlock_new_inode(inode);
908: return error;
909:
910: fail_gunlock4:
911: glock_clear_object(ip->i_gl, ip);
912: glock_clear_object(io_gl, ip);
913: fail_gunlock3:
914: gfs2_glock_dq_uninit(&ip->i_iopen_gh);
915: fail_gunlock2:
916: gfs2_glock_put(io_gl);
917: fail_dealloc_inode:
918: dealloc_error = 0;
919: if (ip->i_eattr)
920: dealloc_error = gfs2_ea_dealloc(ip, xattr_initialized);
921: clear_nlink(inode);
922: mark_inode_dirty(inode);
923: if (!dealloc_error)
924: dealloc_error = gfs2_dinode_dealloc(ip);
925: if (dealloc_error)
926: fs_warn(sdp, "%s: %d\n", __func__, dealloc_error);
927: ip->i_no_addr = 0;
928: fail_free_inode:
929: if (ip->i_gl) {
930: gfs2_glock_put(ip->i_gl);
931: ip->i_gl = NULL;
932: }
933: gfs2_rs_deltree(&ip->i_res);
934: gfs2_qa_put(ip);
935: fail_free_acls:
936: posix_acl_release(default_acl);
937: posix_acl_release(acl);
938: fail_gunlock:
939: gfs2_dir_no_add(&da);
940: gfs2_glock_dq_uninit(&d_gh);
941: if (!IS_ERR_OR_NULL(inode)) {
942: if (inode_state_read_once(inode) & I_NEW)
943: iget_failed(inode);
944: else
945: iput(inode);
946: }
947: if (gfs2_holder_initialized(&gh))
948: gfs2_glock_dq_uninit(&gh);
949: fail:
950: gfs2_qa_put(dip);
951: return error;
952: }
SourceFile:fs/gfs2/inode.c]
|
| 68/2 |
2026/05/24 08:23 |
llm |
expert |
0m
Model:
Tokens:
input: 146856
output: 66
thoughts: 3396
Thoughts: **Analysis of the GFS2 Inode Locking Issue**
Okay, so I've pinpointed the problem. `d_instantiate` exposes the inode to other tasks before `unlock_new_inode` is called. Specifically, `chown_common` calls `inode_lock`. This is at line 895 and 907 respectively. Between these lines there are blocking ops; `finish_open`, `gfs2_glock_dq_uninit`, `gfs2_glock_put` . Then `unlock_new_inode` runs `lockdep_annotate_inode_mutex_key` which subsequently calls `init_rwsem(&inode->i_rwsem)`. It's this reinitialization of `i_rwsem` while other tasks are waiting on it that's causing the `list_del` corruption. This is a very clean root cause, a solid finding.
Now, the exploitability. My initial thought was "list corruption = exploitable", but let's analyze this properly. I will now adjust the findings: Exploitable, no, it is a `false` for exploits. DenialOfService, also `false`, as it's a kernel panic which isn't generally accepted as exploitable in production. Unprivileged and UserNamespace are false. I don't see any dependency on guest or host triggers, network interaction, peripherals, or a malicious filesystem image either, so these will be `false` as well.
The key realization is the role of `CONFIG_LOCKDEP`. I need to double-check whether or not `lockdep_annotate_inode_mutex_key` is actually only active when this debugging tool is enabled. The code confirms it! `lockdep_annotate_inode_mutex_key` is ONLY defined when `CONFIG_LOCKDEP` is enabled. If `CONFIG_LOCKDEP` isn't enabled, it's just an empty inline function, meaning no `init_rwsem` call! My initial assumption that `init_rwsem` was being called by the critical function of the source code is now void.
The prompt specifically says to consider a production build without debugging tools. So now I have to conclude: the bug ONLY exists if `CONFIG_LOCKDEP` is enabled. Production builds typically disable this. And it has KASAN enabled. Syzkaller usually enables `CONFIG_LOCKDEP`. So the report is triggered by a debug build. Without `CONFIG_LOCKDEP`, `init_rwsem` isn't called, the list isn't corrupted, and the bug IS NOT present in production builds.
The only other place that can call `init_rwsem` is `inode_init_always_gfp`. I know this only gets called when the inode is allocated from the slab. However, since the inode is held by a dentry, which is held by a `chown_common` I know it CANNOT be freed and reallocated. This bug, is therefore a very limited false positive.
Okay, so if the bug doesn't exist in production builds, it's not exploitable or a DoS in production. I need to re-read the prompt; it mentions "debugging tools". Is `CONFIG_LOCKDEP` a debugging tool? Yes, it is! If `CONFIG_LOCKDEP` is disabled, the inline function does nothing. The wait list is never corrupted! The bug DOES NOT EXIST in a production build!
Here's the essence of it: `lockdep_annotate_inode_mutex_key` re-initializes a lock that's already in use because the inode is exposed before `unlock_new_inode`. In production builds where `CONFIG_LOCKDEP` is disabled, `lockdep_annotate_inode_mutex_key` is a no-op, and the wait_list isn't corrupted. No crash, no security impact.
I'm checking if `lockdep_annotate_inode_mutex_key` is the only function that touches `i_rwsem` in `unlock_new_inode`. Yes, it's only called when `CONFIG_LOCKDEP` is enabled. Without `CONFIG_LOCKDEP`, there's no touch, the waiting task acquires the lock and blocks. It's completely fine.
Exploitable: false
DenialOfService: false
Unprivileged: false
UserNamespace: false
VMGuestTrigger: false
VMHostTrigger: false
NetworkTrigger: false
RemoteTrigger: false
PeripheralTrigger: false
FilesystemTrigger: false
Now, let's consider another angle: what if `gfs2_create_inode` fails AFTER `d_instantiate`? The code handles this; the error is returned, and the dentry will be evicted. This is also fine, too.
The ONLY
|
| 69/2 |
2026/05/24 08:24 |
tool |
set-results |
0m
Args: map[DenialOfService:false Exploitable:false FilesystemTrigger:false NetworkTrigger:false PeripheralTrigger:false RemoteTrigger:false Unprivileged:false UserNamespace:false VMGuestTrigger:false VMHostTrigger:false]
Results: map[DenialOfService:false Exploitable:false FilesystemTrigger:false NetworkTrigger:false PeripheralTrigger:false RemoteTrigger:false Unprivileged:false UserNamespace:false VMGuestTrigger:false VMHostTrigger:false]
|
| 70/2 |
2026/05/24 08:24 |
llm |
expert |
0m
Model:
Tokens:
input: 151407
output: 771
thoughts: 13
Thoughts: Okay, here's the summary, rendered as your internal thought process:
**Final Response Generation**
Alright, the data is processed, the analysis complete. There's no further need for iteration or refinement on the underlying results. It's time to generate the final, polished response. My focus shifts now from understanding the data to crafting the most effective and insightful presentation. Considerations of tone, clarity, and precision are paramount at this stage. I'll need to synthesize everything, drawing upon my expertise to weave a coherent and impactful narrative from the established facts. The goal is to deliver a definitive conclusion and analysis, formatted for the intended audience, and reflecting the depth of understanding that went into this process. It's time to finalize the presentation, making sure the takeaways are both clear and compelling.
|
| 71/1 |
2026/05/24 08:24 |
action |
format-explanation |
0m
Results: map[Explanation:Based on the analysis of the crash report and the kernel source code, here is
the assessment of the bug:
### Root Cause Analysis
The crash is a `list_del` corruption occurring in `rwsem_try_write_lock` while a
task is executing `chown_common`. The corrupted list is
`inode->i_rwsem.wait_list`.
The sequence of events leading to the crash is as follows:
1. In `gfs2_create_inode`, the newly created inode is exposed to the VFS
prematurely by calling `d_instantiate(dentry, inode)` **before** calling
`unlock_new_inode(inode)`.
2. Because the dentry is now visible in the dcache, another concurrent task
(e.g., an unprivileged user running `chown` on the newly created directory) can
look it up and call `inode_lock_killable(inode)`.
3. The concurrent task acquires or waits on the `inode->i_rwsem`, adding its
`waiter` struct to the `wait_list`.
4. Meanwhile, the original task in `gfs2_create_inode` continues and finally
calls `unlock_new_inode(inode)`.
5. `unlock_new_inode` calls `lockdep_annotate_inode_mutex_key(inode)`. For
directories, this function assumes no one is holding the lock yet and explicitly
reinitializes it by calling `init_rwsem(&inode->i_rwsem)`.
6. This reinitialization clears the `wait_list` (setting `prev` and `next` to
point to the list head itself).
7. When the concurrent task wakes up and tries to remove its `waiter` from the
list via `list_del()`, it detects that the list head does not point back to the
`waiter`, triggering the `list_del corruption` BUG.
### Security Impact in Production Builds
While this causes a kernel BUG and a Denial of Service in the syzkaller
environment, **it has zero security impact in production builds**.
The function responsible for reinitializing the lock,
`lockdep_annotate_inode_mutex_key()`, is strictly a debugging feature. It is
conditionally compiled and only does anything if `CONFIG_LOCKDEP` is enabled:
```c
#ifdef CONFIG_LOCKDEP
void lockdep_annotate_inode_mutex_key(struct inode *inode)
{
...
init_rwsem(&inode->i_rwsem);
...
}
#else
static inline void lockdep_annotate_inode_mutex_key(struct inode *inode) { }
#endif
```
In a standard production kernel without debugging tools enabled (i.e.,
`CONFIG_LOCKDEP` is disabled), `lockdep_annotate_inode_mutex_key` is an empty
inline function. Consequently, `init_rwsem` is **never** called on the
already-exposed inode, and the `wait_list` is never corrupted.
The concurrent task will simply acquire the `i_rwsem` and then safely block on
the GFS2 internal glock (`ip->i_gl`), which is still correctly held by
`gfs2_create_inode` until it finishes its setup. There is no memory corruption,
no use-after-free, and no crash.
### Conclusion
This is a lockdep-induced false positive caused by a minor ordering issue in
GFS2 (`d_instantiate` before `unlock_new_inode`). It is not exploitable and
cannot cause a Denial of Service in production environments.]
|