FAILED: patch "[PATCH] drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout" failed to apply to 6.18-stable tree
Subsystems (4)
[email protected]
maintainerThe patch below does not apply to the 6.18-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.18.y
git checkout FETCH_HEAD
git cherry-pick -x b2ed01e7ad3de80333e9b962a44024b094bc0b2b
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026052035-sweat-creed-1388@gregkh' --subject-prefix 'PATCH 6.18.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From b2ed01e7ad3de80333e9b962a44024b094bc0b2b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20Hellstr=C3=B6m?= <[email protected]>
Date: Tue, 28 Apr 2026 11:44:42 +0200
Subject: [PATCH] drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout
failure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
When ttm_tt_swapout() fails, the current code calls ttm_resource_add_bulk_move() followed by ttm_resource_move_to_lru_tail() to restore the resource's bulk_move membership.
However, ttm_resource_move_to_lru_tail() places the resource at the tail of the LRU list which, relative to the walk cursor's hitch node (placed immediately after the resource when it was yielded), puts the resource *in front of the* the hitch. The next list_for_each_entry_continue() from the hitch finds the same resource again, causing an infinite loop.
Fix by deferring del_bulk_move to the success path only.
On the success path, TTM_TT_FLAG_SWAPPED has just been set by ttm_tt_swapout() but the resource is still tracked in the bulk_move range, so ttm_resource_del_bulk_move()'s !ttm_resource_unevictable() guard would incorrectly skip the removal. Introduce ttm_resource_del_bulk_move_unevictable() which bypasses that guard.
drivers/gpu/drm/ttm/ttm_bo.c +6 -10
@@ -1177,17 +1177,13 @@ ttm_bo_swapout_cb(struct ttm_lru_walk *walk, struct ttm_buffer_object *bo) bdev->funcs->swap_notify (bo);if (ttm_tt_is_populated (tt)) { -spin_lock (&bdev->lru_lock); -ttm_resource_del_bulk_move (bo->resource, bo); -spin_unlock (&bdev->lru_lock); - ret =ttm_tt_swapout (bdev, tt, swapout_walk->gfp_flags); - -spin_lock (&bdev->lru_lock); -if (ret) -ttm_resource_add_bulk_move (bo->resource, bo); -ttm_resource_move_to_lru_tail (bo->resource); -spin_unlock (&bdev->lru_lock); +if (!ret) { +spin_lock (&bdev->lru_lock); +ttm_resource_del_bulk_move_unevictable (bo->resource, bo); +ttm_resource_move_to_lru_tail (bo->resource); +spin_unlock (&bdev->lru_lock); + } } out:
drivers/gpu/drm/ttm/ttm_resource.c +13 -0
@@ -292,6 +292,19 @@ void ttm_resource_del_bulk_move(struct ttm_resource *res,ttm_lru_bulk_move_del (bo->bulk_move, res); } +/* +* Remove a resource from its bulk_move, bypassing the unevictable check. +* Use only when the resource is known to still be tracked in the range despite +* the BO having just become unevictable; asserts that this is the case. +*/ +void ttm_resource_del_bulk_move_unevictable (struct ttm_resource *res, +struct ttm_buffer_object *bo) +{ +WARN_ON_ONCE (!ttm_resource_unevictable (res, bo)); +if (bo->bulk_move) +ttm_lru_bulk_move_del (bo->bulk_move, res); +} +/* Move a resource to the LRU or bulk tail */ void ttm_resource_move_to_lru_tail (struct ttm_resource *res) {
include/drm/ttm/ttm_resource.h +2 -0
@@ -448,6 +448,8 @@ void ttm_resource_add_bulk_move(struct ttm_resource *res, struct ttm_buffer_object *bo);void ttm_resource_del_bulk_move (struct ttm_resource *res,struct ttm_buffer_object *bo); +void ttm_resource_del_bulk_move_unevictable (struct ttm_resource *res, +struct ttm_buffer_object *bo);void ttm_resource_move_to_lru_tail (struct ttm_resource *res); void ttm_resource_init(struct ttm_buffer_object *bo,