- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer
by Liu Kai 04 Jan '26

04 Jan '26

From: Owen Gu <guhuinan(a)xiaomi.com> stable inclusion from stable-v6.6.119 commit e3a55221f4de080cb7a91ba10f01c4f708603f8d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/12692 CVE: CVE-2025-68331 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 26d56a9fcb2014b99e654127960aa0a48a391e3c upstream. When a UAS device is unplugged during data transfer, there is a probability of a system panic occurring. The root cause is an access to an invalid memory address during URB callback handling. Specifically, this happens when the dma_direct_unmap_sg() function is called within the usb_hcd_unmap_urb_for_dma() interface, but the sg->dma_address field is 0 and the sg data structure has already been freed. The SCSI driver sends transfer commands by invoking uas_queuecommand_lck() in uas.c, using the uas_submit_urbs() function to submit requests to USB. Within the uas_submit_urbs() implementation, three URBs (sense_urb, data_urb, and cmd_urb) are sequentially submitted. Device removal may occur at any point during uas_submit_urbs execution, which may result in URB submission failure. However, some URBs might have been successfully submitted before the failure, and uas_submit_urbs will return the -ENODEV error code in this case. The current error handling directly calls scsi_done(). In the SCSI driver, this eventually triggers scsi_complete() to invoke scsi_end_request() for releasing the sgtable. The successfully submitted URBs, when being unlinked to giveback, call usb_hcd_unmap_urb_for_dma() in hcd.c, leading to exceptions during sg unmapping operations since the sg data structure has already been freed. This patch modifies the error condition check in the uas_submit_urbs() function. When a UAS device is removed but one or more URBs have already been successfully submitted to USB, it avoids immediately invoking scsi_done() and save the cmnd to devinfo->cmnd array. If the successfully submitted URBs is completed before devinfo->resetting being set, then the scsi_done() function will be called within uas_try_complete() after all pending URB operations are finalized. Otherwise, the scsi_done() function will be called within uas_zap_pending(), which is executed after usb_kill_anchored_urbs(). The error handling only takes effect when uas_queuecommand_lck() calls uas_submit_urbs() and returns the error value -ENODEV . In this case, the device is disconnected, and the flow proceeds to uas_disconnect(), where uas_zap_pending() is invoked to call uas_try_complete(). Fixes: eb2a86ae8c54 ("USB: UAS: fix disconnect by unplugging a hub") Cc: stable <stable(a)kernel.org> Signed-off-by: Yu Chen <chenyu45(a)xiaomi.com> Signed-off-by: Owen Gu <guhuinan(a)xiaomi.com> Acked-by: Oliver Neukum <oneukum(a)suse.com> Link: https://patch.msgid.link/20251120123336.3328-1-guhuinan@xiaomi.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- drivers/usb/storage/uas.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c index f794cb39cc31..b54b4bfeb45e 100644 --- a/drivers/usb/storage/uas.c +++ b/drivers/usb/storage/uas.c @@ -697,6 +697,10 @@ static int uas_queuecommand_lck(struct scsi_cmnd *cmnd) * of queueing, no matter how fatal the error */ if (err == -ENODEV) { + if (cmdinfo->state & (COMMAND_INFLIGHT | DATA_IN_URB_INFLIGHT | + DATA_OUT_URB_INFLIGHT)) + goto out; + set_host_byte(cmnd, DID_NO_CONNECT); scsi_done(cmnd); goto zombie; @@ -710,6 +714,7 @@ static int uas_queuecommand_lck(struct scsi_cmnd *cmnd) uas_add_work(cmnd); } +out: devinfo->cmnd[idx] = cmnd; zombie: spin_unlock_irqrestore(&devinfo->lock, flags); -- 2.34.1

2 1

[PATCH OLK-6.6] nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot
by Liu Kai 04 Jan '26

04 Jan '26

From: Nam Cao <namcao(a)linutronix.de> stable inclusion from stable-v6.6.118 commit 7d1977b4ae5c50e1aafc5c51500fc08bd7afd6a0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11587 CVE: CVE-2025-68235 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 949f1fd2225baefbea2995afa807dba5cbdb6bd3 upstream. nvkm_falcon_fw::boot is allocated, but no one frees it. This causes a kmemleak warning. Make sure this data is deallocated. Fixes: 2541626cfb79 ("drm/nouveau/acr: use common falcon HS FW code for ACR FWs") Signed-off-by: Nam Cao <namcao(a)linutronix.de> Cc: stable(a)vger.kernel.org Reviewed-by: Lyude Paul <lyude(a)redhat.com> Signed-off-by: Lyude Paul <lyude(a)redhat.com> Link: https://patch.msgid.link/20251117084231.2910561-1-namcao@linutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- drivers/gpu/drm/nouveau/nvkm/falcon/fw.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/nouveau/nvkm/falcon/fw.c b/drivers/gpu/drm/nouveau/nvkm/falcon/fw.c index cac6d64ab67d..4e8b3f1c7e25 100644 --- a/drivers/gpu/drm/nouveau/nvkm/falcon/fw.c +++ b/drivers/gpu/drm/nouveau/nvkm/falcon/fw.c @@ -159,6 +159,8 @@ nvkm_falcon_fw_dtor(struct nvkm_falcon_fw *fw) nvkm_memory_unref(&fw->inst); nvkm_falcon_fw_dtor_sigs(fw); nvkm_firmware_dtor(&fw->fw); + kfree(fw->boot); + fw->boot = NULL; } static const struct nvkm_firmware_func -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: Free special fields when update [lru_,]percpu_hash maps
by Pu Lehui 04 Jan '26

04 Jan '26

From: Leon Hwang <leon.hwang(a)linux.dev> mainline inclusion from mainline-v6.19-rc1 commit 6af6e49a76c9af7d42eb923703e7648cb2bf401a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/12885 CVE: CVE-2025-68744 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- As [lru_,]percpu_hash maps support BPF_KPTR_{REF,PERCPU}, missing calls to 'bpf_obj_free_fields()' in 'pcpu_copy_value()' could cause the memory referenced by BPF_KPTR_{REF,PERCPU} fields to be held until the map gets freed. Fix this by calling 'bpf_obj_free_fields()' after 'copy_map_value[,_long]()' in 'pcpu_copy_value()'. Fixes: 65334e64a493 ("bpf: Support kptrs in percpu hashmap and percpu LRU hashmap") Signed-off-by: Leon Hwang <leon.hwang(a)linux.dev> Acked-by: Yonghong Song <yonghong.song(a)linux.dev> Link: https://lore.kernel.org/r/20251105151407.12723-2-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/hashtab.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c index fdc74aeaa164..46e833e5666b 100644 --- a/kernel/bpf/hashtab.c +++ b/kernel/bpf/hashtab.c @@ -957,15 +957,21 @@ static void free_htab_elem(struct bpf_htab *htab, struct htab_elem *l) static void pcpu_copy_value(struct bpf_htab *htab, void __percpu *pptr, void *value, bool onallcpus) { + void *ptr; + if (!onallcpus) { /* copy true value_size bytes */ - copy_map_value(&htab->map, this_cpu_ptr(pptr), value); + ptr = this_cpu_ptr(pptr); + copy_map_value(&htab->map, ptr, value); + bpf_obj_free_fields(htab->map.record, ptr); } else { u32 size = round_up(htab->map.value_size, 8); int off = 0, cpu; for_each_possible_cpu(cpu) { - copy_map_value_long(&htab->map, per_cpu_ptr(pptr, cpu), value + off); + ptr = per_cpu_ptr(pptr, cpu); + copy_map_value_long(&htab->map, ptr, value + off); + bpf_obj_free_fields(htab->map.record, ptr); off += size; } } -- 2.34.1

2 1

[PATCH OLK-5.10] NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL
by Li Lingfeng 04 Jan '26

04 Jan '26

From: Chuck Lever <chuck.lever(a)oracle.com> stable inclusion from stable-v5.10.220 commit 50827896c365e0f6c8b55ed56d444dafd87c92c5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/7998 CVE: CVE-2023-53680 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 804d8e0a6e54427268790472781e03bc243f4ee3 ] OPDESC() simply indexes into nfsd4_ops[] by the op's operation number, without range checking that value. It assumes callers are careful to avoid calling it with an out-of-bounds opnum value. nfsd4_decode_compound() is not so careful, and can invoke OPDESC() with opnum set to OP_ILLEGAL, which is 10044 -- well beyond the end of nfsd4_ops[]. Reported-by: Jeff Layton <jlayton(a)kernel.org> Fixes: f4f9ef4a1b0a ("nfsd4: opdesc will be useful outside nfs4proc.c") Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/nfsd/nfs4xdr.c [Commit 3a237b4af5b7 ("NFSD: Make nfsd4_ops::opnum a u32") change the way to get opnum.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4xdr.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c index 31d56546021b..821c0ad5baa0 100644 --- a/fs/nfsd/nfs4xdr.c +++ b/fs/nfsd/nfs4xdr.c @@ -2244,17 +2244,19 @@ nfsd4_decode_compound(struct nfsd4_compoundargs *argp) for (i = 0; i < argp->opcnt; i++) { op = &argp->ops[i]; op->replay = NULL; + op->opdesc = NULL; READ_BUF(4); op->opnum = be32_to_cpup(p++); - if (nfsd4_opnum_in_range(argp, op)) + if (nfsd4_opnum_in_range(argp, op)) { + op->opdesc = OPDESC(op); op->status = nfsd4_dec_ops[op->opnum](argp, &op->u); - else { + } else { op->opnum = OP_ILLEGAL; op->status = nfserr_op_illegal; } - op->opdesc = OPDESC(op); + /* * We'll try to cache the result in the DRC if any one * op in the compound wants to be cached: -- 2.52.0

2 1

[PATCH OLK-6.6] net_sched: prio: fix a race in prio_tune()
by Zhang Changzhong 04 Jan '26

04 Jan '26

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.6.94 commit 46c15c9d0f65c9ba857d63f53264f4b17e8a715f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/12473 CVE: CVE-2025-38083 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d35acc1be3480505b5931f17e4ea9b7617fea4d3 ] Gerrard Tai reported a race condition in PRIO, whenever SFQ perturb timer fires at the wrong time. The race is as follows: CPU 0 CPU 1 [1]: lock root [2]: qdisc_tree_flush_backlog() [3]: unlock root | | [5]: lock root | [6]: rehash | [7]: qdisc_tree_reduce_backlog() | [4]: qdisc_put() This can be abused to underflow a parent's qlen. Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock. Fixes: 7b8e0b6e6599 ("net: sched: prio: delay destroying child qdiscs on change") Reported-by: Gerrard Tai <gerrard.tai(a)starlabs.sg> Suggested-by: Gerrard Tai <gerrard.tai(a)starlabs.sg> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20250611111515.1983366-2-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/sched/sch_prio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c index fdc5ef5..fdd9caa 100644 --- a/net/sched/sch_prio.c +++ b/net/sched/sch_prio.c @@ -211,7 +211,7 @@ static int prio_tune(struct Qdisc *sch, struct nlattr *opt, memcpy(q->prio2band, qopt->priomap, TC_PRIO_MAX+1); for (i = q->bands; i < oldbands; i++) - qdisc_tree_flush_backlog(q->queues[i]); + qdisc_purge_queue(q->queues[i]); for (i = oldbands; i < q->bands; i++) { q->queues[i] = queues[i]; -- 2.9.5

2 1

[PATCH OLK-6.6 0/2] CVE-2025-39925
by Zhang Changzhong 04 Jan '26

04 Jan '26

Tetsuo Handa (2): can: j1939: implement NETDEV_UNREGISTER notification handler can: j1939: add missing calls in NETDEV_UNREGISTER notification handler net/can/j1939/j1939-priv.h | 1 + net/can/j1939/main.c | 5 +++++ net/can/j1939/socket.c | 49 ++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 55 insertions(+) -- 2.9.5

2 3

[PATCH OLK-6.6] Bluetooth: hci_core: Disable works on hci_unregister_dev
by Zhang Changzhong 04 Jan '26

04 Jan '26

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> mainline inclusion from mainline-v6.12-rc5 commit 989fa5171f005ecf63440057218d8aeb1795287d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/8399 CVE: CVE-2024-58241 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This make use of disable_work_* on hci_unregister_dev since the hci_dev is about to be freed new submissions are not disarable. Fixes: 0d151a103775 ("Bluetooth: hci_core: cancel all works upon hci_unregister_dev()") Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Conflicts: net/bluetooth/hci_sync.c [commit 78db544b5d27 ("Bluetooth: hci_core: Remove le_restart_scan work") and f2d897753586 ("Bluetooth: hci_sync: Remove remaining dependencies of hci_request") not merged] Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/bluetooth/hci_core.c | 24 +++++++++++++++--------- net/bluetooth/hci_sync.c | 15 +++++++++++---- 2 files changed, 26 insertions(+), 13 deletions(-) diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index c5e3ae5..4b4e3579 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -1638,12 +1638,12 @@ void hci_adv_instances_clear(struct hci_dev *hdev) struct adv_info *adv_instance, *n; if (hdev->adv_instance_timeout) { - cancel_delayed_work(&hdev->adv_instance_expire); + disable_delayed_work(&hdev->adv_instance_expire); hdev->adv_instance_timeout = 0; } list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) { - cancel_delayed_work_sync(&adv_instance->rpa_expired_cb); + disable_delayed_work_sync(&adv_instance->rpa_expired_cb); list_del(&adv_instance->list); kfree(adv_instance); } @@ -2670,11 +2670,11 @@ void hci_unregister_dev(struct hci_dev *hdev) list_del(&hdev->list); write_unlock(&hci_dev_list_lock); - cancel_work_sync(&hdev->rx_work); - cancel_work_sync(&hdev->cmd_work); - cancel_work_sync(&hdev->tx_work); - cancel_work_sync(&hdev->power_on); - cancel_work_sync(&hdev->error_reset); + disable_work_sync(&hdev->rx_work); + disable_work_sync(&hdev->cmd_work); + disable_work_sync(&hdev->tx_work); + disable_work_sync(&hdev->power_on); + disable_work_sync(&hdev->error_reset); hci_cmd_sync_clear(hdev); @@ -2781,8 +2781,14 @@ static void hci_cancel_cmd_sync(struct hci_dev *hdev, int err) { bt_dev_dbg(hdev, "err 0x%2.2x", err); - cancel_delayed_work_sync(&hdev->cmd_timer); - cancel_delayed_work_sync(&hdev->ncmd_timer); + if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) { + disable_delayed_work_sync(&hdev->cmd_timer); + disable_delayed_work_sync(&hdev->ncmd_timer); + } else { + cancel_delayed_work_sync(&hdev->cmd_timer); + cancel_delayed_work_sync(&hdev->ncmd_timer); + } + atomic_set(&hdev->cmd_cnt, 1); hci_cmd_sync_cancel_sync(hdev, err); diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c index e086f29..9d31b78 100644 --- a/net/bluetooth/hci_sync.c +++ b/net/bluetooth/hci_sync.c @@ -5158,10 +5158,17 @@ int hci_dev_close_sync(struct hci_dev *hdev) bt_dev_dbg(hdev, ""); - cancel_delayed_work(&hdev->power_off); - cancel_delayed_work(&hdev->ncmd_timer); - cancel_delayed_work(&hdev->le_scan_disable); - cancel_delayed_work(&hdev->le_scan_restart); + if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) { + disable_delayed_work(&hdev->power_off); + disable_delayed_work(&hdev->ncmd_timer); + disable_delayed_work(&hdev->le_scan_disable); + disable_delayed_work(&hdev->le_scan_restart); + } else { + cancel_delayed_work(&hdev->power_off); + cancel_delayed_work(&hdev->ncmd_timer); + cancel_delayed_work(&hdev->le_scan_disable); + cancel_delayed_work(&hdev->le_scan_restart); + } hci_request_cancel_all(hdev); -- 2.9.5

2 1

[PATCH OLK-6.6] iomap: fix dirty range tracking in iomap_folio_mkwrite_iter
by Long Li 04 Jan '26

04 Jan '26

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IDCSJV ----------------------------------------- When I test xfs with fsstress, got the following assert message: XFS (sda): ino 1a0b0a data fork has delalloc extent at [0x186:0x1] XFS: Assertion failed: 0, file: fs/xfs/xfs_icache.c, line: 1819 ------------[ cut here ]------------ kernel BUG at fs/xfs/xfs_message.c:102! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 3 PID: 940 Comm: kworker/3:1 Not tainted 6.6.0-g3697dae9bfac #192 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 Workqueue: xfs-inodegc/sda xfs_inodegc_worker RIP: 0010:assfail+0x54/0x60 RSP: 0018:ffffc90003113e08 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ffff8880651dd800 RCX: 000000007fffffff RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff82a12e0c RBP: ffffffffffffff20 R08: 00000000000025c2 R09: 0000000000000000 R10: 000000000000000a R11: 000000000000000a R12: 0000000000000000 R13: ffffffffffffff20 R14: ffff888077948000 R15: 0000000004208060 FS: 0000000000000000(0000) GS:ffff8880bcb80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000561be0e1cf30 CR3: 0000000075fa4000 CR4: 00000000000006e0 Call Trace: <TASK> xfs_inodegc_set_reclaimable+0x1f1/0x220 xfs_inodegc_worker+0x10b/0x2e0 process_scheduled_works+0x1a5/0x5e0 worker_thread+0x1d1/0x4f0 ? apply_workqueue_attrs+0x70/0x70 kthread+0x149/0x1c0 ? kthread_exit+0x50/0x50 ret_from_fork+0x52/0x70 ? kthread_exit+0x50/0x50 ret_from_fork_asm+0x11/0x20 </TASK> Fix the incorrect dirty range tracking in iomap_folio_mkwrite_iter() which could lead to blocks being missed during writeback. Previously, iomap_set_range_dirty() was called with a wrong offset (0), which may cause some modified blocks not being marked as dirty and thus skip writeback. Calculate the correct offset within the folio from the iterator position to ensure all modified blocks are properly marked dirty and written back. Fixes: 0b4d2d8fba90 ("iomap: correct the dirty length in page mkwrite") Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/iomap/buffered-io.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c index 7a417bd8a9f3..33fbb3f8d45f 100644 --- a/fs/iomap/buffered-io.c +++ b/fs/iomap/buffered-io.c @@ -1562,10 +1562,12 @@ static loff_t iomap_folio_mkwrite_iter(struct iomap_iter *iter, return ret; block_commit_write(&folio->page, 0, length); } else { + size_t poff = offset_in_folio(folio, iter->pos); + WARN_ON_ONCE(!folio_test_uptodate(folio)); ifs_alloc(iter->inode, folio, 0); - iomap_set_range_dirty(folio, 0, length); + iomap_set_range_dirty(folio, poff, length); } return length; -- 2.39.2

2 1

[PATCH OLK-5.10] mm: mem_reliable: prevent excessive direct reclaim loops
by Wupeng Ma 04 Jan '26

04 Jan '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/5441 ------------------------------------------ In our testing, under memory pressure, it becomes difficult totrigger an OOM(out-of-memory) kill when regular memory allocation competes concurrently with driver GFP_ATOMIC allocations. This occurs because GFP_ATOMIC allocations can succeed from as low as 3/8 of the min watermark. In such a situation, even if direct reclaim can free a small number of pages, regular memory requests may still fail because the current watermark remains too high for them. In the following scenario: restart: __alloc_pages_direct_reclaim // reclaims a small number of pages should_reclaim_retry // watermark too high for user // resets no_progress_loops to zero and // goes to restart goto restart; In our production environment, we encountered a case where memory allocation performed __alloc_pages_direct_reclaim 257 times without either succeeding or triggering OOM, causing service freezes. To avoid meaningless continuous direct reclaim loops, skip watermark check for non mirrored zone if memory reliable enabled. Fixes: 6c59ddf2139d ("mm: Introduce memory reliable") Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- mm/page_alloc.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/mm/page_alloc.c b/mm/page_alloc.c index d6b23b59ae42..72d5303f8000 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -4630,6 +4630,9 @@ should_reclaim_retry(gfp_t gfp_mask, unsigned order, unsigned long min_wmark = min_wmark_pages(zone); bool wmark; + if (skip_none_movable_zone(gfp_mask, z)) + continue; + available = reclaimable = zone_reclaimable_pages(zone); available += zone_page_state_snapshot(zone, NR_FREE_PAGES); -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] mm: mem_reliable: prevent excessive direct reclaim loops
by Wupeng Ma 04 Jan '26

04 Jan '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/5441 ------------------------------------------ In our testing, under memory pressure, it becomes difficult totrigger an OOM(out-of-memory) kill when regular memory allocation competes concurrently with driver GFP_ATOMIC allocations. This occurs because GFP_ATOMIC allocations can succeed from as low as 3/8 of the min watermark. In such a situation, even if direct reclaim can free a small number of pages, regular memory requests may still fail because the current watermark remains too high for them. In the following scenario: restart: __alloc_pages_direct_reclaim // reclaims a small number of pages should_reclaim_retry // watermark too high for user // resets no_progress_loops to zero and // goes to restart goto restart; In our production environment, we encountered a case where memory allocation performed __alloc_pages_direct_reclaim 257 times without either succeeding or triggering OOM, causing service freezes. To avoid meaningless continuous direct reclaim loops, skip watermark check for non mirrored zone if memory reliable enabled. Fixes: 33d1f46ad98e ("mm: Introduce memory reliable") Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- mm/page_alloc.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 787bbabc29d0..c2577d3048d9 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -4256,6 +4256,9 @@ should_reclaim_retry(gfp_t gfp_mask, unsigned order, unsigned long min_wmark = min_wmark_pages(zone); bool wmark; + if (skip_none_movable_zone(gfp_mask, z)) + continue; + available = reclaimable = zone_reclaimable_pages(zone); available += zone_page_state_snapshot(zone, NR_FREE_PAGES); -- 2.43.0

2 1