Re: [Regression] 6.12 port of CVE-2026-64415

On Tue, Aug 11, 2026 at 03:14:16PM +0200, Guillaume Morin wrote:
> Hi, 
> 
> The backport to 6.12 (commit 60cbe67d1342f34b66df1c2ee328e3cd333767d7)
> of 66366d291f666ddeda5f8c84f253e308de3e6b55 "mm/swap: add cond_resched()
> in swap_reclaim_full_clusters to prevent softlockup" seems to introduce
> a regression.
> 
> The cond_resched() is called while holding a spinlock:
> 
> diff --git a/mm/swapfile.c b/mm/swapfile.c
> index 883333a87a45..552df432c37f 100644
> --- a/mm/swapfile.c
> +++ b/mm/swapfile.c
> @@ -767,20 +767,21 @@ static void swap_reclaim_full_clusters(struct swap_info_struct *si, bool force)
>                                         offset += abs(nr_reclaim);
>                                         continue;
>                                 }
>                         }
>                         offset++;
>                 }
>                 spin_lock(&si->lock);
>  
>                 if (to_scan <= 0)
>                         break;
> +               cond_resched();
>         }
>  }
> 
> The 7.1 and 6.18 backports do properly call cond_resched() after
> releasing the equivalent lock.
> 
> Simply moving the cond_resched() will fix the issue:
> 
> --- a/mm/swapfile.c
> +++ b/mm/swapfile.c
> @@ -770,11 +770,11 @@ static void swap_reclaim_full_clusters(struct swap_info_struct *si, bool force)
>                         }
>                         offset++;
>                 }
> +               cond_resched();
>                 spin_lock(&si->lock);
>  
>                 if (to_scan <= 0)
>                         break;
> -               cond_resched();
>         }
>  }
> 
> 
> HTH
> 
> -- 
> Guillaume Morin <[email protected]>

Can you send a patch to fix this?

thanks,

greg k-h