Date: Tue, 11 Aug 2026 15:14:16 +0200
From: Guillaume Morin <guillaume@morinfr.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, sashal@kernel.org,
	Zijiang Huang <huangzjsmile@gmail.com>,
	Kairui Song <kasong@tencent.com>, Hao Peng <flyingpeng@tencent.com>,
	albinwyang <albinwyang@tencent.com>,
	Baoquan He <baoquan.he@linux.dev>
Subject: [Regression] 6.12 port of CVE-2026-64415
Message-ID: <ansgKOOXi6KE3oKf@bender.morinfr.org>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Hi, 

The backport to 6.12 (commit 60cbe67d1342f34b66df1c2ee328e3cd333767d7)
of 66366d291f666ddeda5f8c84f253e308de3e6b55 "mm/swap: add cond_resched()
in swap_reclaim_full_clusters to prevent softlockup" seems to introduce
a regression.

The cond_resched() is called while holding a spinlock:

diff --git a/mm/swapfile.c b/mm/swapfile.c
index 883333a87a45..552df432c37f 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -767,20 +767,21 @@ static void swap_reclaim_full_clusters(struct swap_info_struct *si, bool force)
                                        offset += abs(nr_reclaim);
                                        continue;
                                }
                        }
                        offset++;
                }
                spin_lock(&si->lock);
 
                if (to_scan <= 0)
                        break;
+               cond_resched();
        }
 }

The 7.1 and 6.18 backports do properly call cond_resched() after
releasing the equivalent lock.

Simply moving the cond_resched() will fix the issue:

--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -770,11 +770,11 @@ static void swap_reclaim_full_clusters(struct swap_info_struct *si, bool force)
                        }
                        offset++;
                }
+               cond_resched();
                spin_lock(&si->lock);
 
                if (to_scan <= 0)
                        break;
-               cond_resched();
        }
 }


HTH

-- 
Guillaume Morin <guillaume@morinfr.org>