6.12 port of CVE-2026-64415

Hi,

The backport to 6.12 (commit 60cbe67d1342f34b66df1c2ee328e3cd333767d7) of 66366d291f666ddeda5f8c84f253e308de3e6b55 "mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup" seems to introduce a regression.

The cond_resched() is called while holding a spinlock:

mm/swapfile.c +1 -0

index 883333a87a45..552df432c37f 100644
@@ -767,20 +767,21 @@ static void swap_reclaim_full_clusters(struct swap_info_struct *si, bool force)
                                        offset += abs(nr_reclaim);
                                        continue;
                                }
                        }
                        offset++;
                }
                spin_lock(&si->lock);
 
                if (to_scan <= 0)
                        break;
+               cond_resched();
        }
 }
 

The 7.1 and 6.18 backports do properly call cond_resched() after releasing the equivalent lock.

Simply moving the cond_resched() will fix the issue:

mm/swapfile.c +1 -1

@@ -770,11 +770,11 @@ static void swap_reclaim_full_clusters(struct swap_info_struct *si, bool force)
                        }
                        offset++;
                }
+               cond_resched();
                spin_lock(&si->lock);
 
                if (to_scan <= 0)
                        break;
-               cond_resched();
        }
 }
 

HTH

Signature · 1 line

Guillaume Morin <[email protected]>

Can you send a patch to fix this?