Date: Wed, 12 Aug 2026 09:14:34 +0900
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: Guillaume Morin <guillaume@morinfr.org>
Cc: stable@vger.kernel.org, sashal@kernel.org,
	Zijiang Huang <huangzjsmile@gmail.com>,
	Kairui Song <kasong@tencent.com>, Hao Peng <flyingpeng@tencent.com>,
	albinwyang <albinwyang@tencent.com>,
	Baoquan He <baoquan.he@linux.dev>
Subject: Re: [Regression] 6.12 port of CVE-2026-64415
Message-ID: <2026081226-herself-obvious-3955@gregkh>
References: <ansgKOOXi6KE3oKf@bender.morinfr.org>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <ansgKOOXi6KE3oKf@bender.morinfr.org>

On Tue, Aug 11, 2026 at 03:14:16PM +0200, Guillaume Morin wrote:
> Hi, 
> 
> The backport to 6.12 (commit 60cbe67d1342f34b66df1c2ee328e3cd333767d7)
> of 66366d291f666ddeda5f8c84f253e308de3e6b55 "mm/swap: add cond_resched()
> in swap_reclaim_full_clusters to prevent softlockup" seems to introduce
> a regression.
> 
> The cond_resched() is called while holding a spinlock:
> 
> diff --git a/mm/swapfile.c b/mm/swapfile.c
> index 883333a87a45..552df432c37f 100644
> --- a/mm/swapfile.c
> +++ b/mm/swapfile.c
> @@ -767,20 +767,21 @@ static void swap_reclaim_full_clusters(struct swap_info_struct *si, bool force)
>                                         offset += abs(nr_reclaim);
>                                         continue;
>                                 }
>                         }
>                         offset++;
>                 }
>                 spin_lock(&si->lock);
>  
>                 if (to_scan <= 0)
>                         break;
> +               cond_resched();
>         }
>  }
> 
> The 7.1 and 6.18 backports do properly call cond_resched() after
> releasing the equivalent lock.
> 
> Simply moving the cond_resched() will fix the issue:
> 
> --- a/mm/swapfile.c
> +++ b/mm/swapfile.c
> @@ -770,11 +770,11 @@ static void swap_reclaim_full_clusters(struct swap_info_struct *si, bool force)
>                         }
>                         offset++;
>                 }
> +               cond_resched();
>                 spin_lock(&si->lock);
>  
>                 if (to_scan <= 0)
>                         break;
> -               cond_resched();
>         }
>  }
> 
> 
> HTH
> 
> -- 
> Guillaume Morin <guillaume@morinfr.org>

Can you send a patch to fix this?

thanks,

greg k-h