From nobody Mon Feb 9 21:44:12 2026 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B28FB23816E; Thu, 7 Aug 2025 13:05:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=124.126.103.232 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1754571933; cv=none; b=Mqm1VaNzbiyapxi44iH1m8ncdUFbKSJCeK/WFpmq5+vGrjYB25Kn27sK1muHOf1iYi87NtrTZ0YNfqidi5k+Y2JLzn/FUueyAR9qyyIaJIB4uQqdNfcJ0G/+CeaT/LJkg6DBgGKiYI06dnSjs4MkzZHtBErTqGWwxR86tRiAybs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1754571933; c=relaxed/simple; bh=wFXb5lAQXTDrmzUC6XfMd0dRpKtnEjFNW4RV0ePxg8s=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=fP2UcuDW4KREU5Ey/PI4oWTn1J/FC09MPNVGsfB+TTMj74pex9+IvDID9IzNdG5pxTR44JjcCJftQHlfCESbL61lfknSfHIejA8vWTLERY5pUMVuiVH5zH6uGyXOlejSbveDmY7ewN81suPfZOjiLvO0lOXCgD9Guj80As//Xr8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn; spf=pass smtp.mailfrom=kylinos.cn; arc=none smtp.client-ip=124.126.103.232 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kylinos.cn X-UUID: 2d8da2ee738f11f0b29709d653e92f7d-20250807 X-CTIC-Tags: HR_CC_COUNT, HR_CC_DOMAIN_COUNT, HR_CC_NAME, HR_CC_NO_NAME, HR_CTE_QP HR_CTT_MISS, HR_DATE_H, HR_DATE_WKD, HR_DATE_ZONE, HR_SJ_DIGIT_LEN HR_SJ_LANG, HR_SJ_LEN, HR_SJ_LETTER, HR_SJ_NOR_SYM, HR_SJ_PHRASE HR_SJ_PHRASE_LEN, HR_SJ_WS, HR_TO_COUNT, HR_TO_DOMAIN_COUNT, HR_TO_NO_NAME IP_TRUSTED, SRC_TRUSTED, DN_TRUSTED, SA_UNTRUSTED, SA_UNFAMILIAR SPF_NOPASS, DKIM_NOPASS, DMARC_NOPASS, CIE_BAD, CIE_GOOD_SPF GTI_FG_BS, GTI_RG_INFO, GTI_C_BU, AMN_T1, AMN_GOOD AMN_C_TI, AMN_C_BU, ABX_MISS_RDNS X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.1.45,REQID:7e20fc9a-254b-4258-9f29-81d1d9c5fa59,IP:10, URL:0,TC:0,Content:0,EDM:0,RT:0,SF:-5,FILE:0,BULK:0,RULE:Release_Ham,ACTIO N:release,TS:5 X-CID-INFO: VERSION:1.1.45,REQID:7e20fc9a-254b-4258-9f29-81d1d9c5fa59,IP:10,UR L:0,TC:0,Content:0,EDM:0,RT:0,SF:-5,FILE:0,BULK:0,RULE:Release_Ham,ACTION: release,TS:5 X-CID-META: VersionHash:6493067,CLOUDID:c2842ccf03033012f8abbe80433b3499,BulkI D:2508072055154RQQU8EA,BulkQuantity:1,Recheck:0,SF:19|24|44|66|72|78|81|82 |102,TC:nil,Content:0|50,EDM:-3,IP:-2,URL:0,File:nil,RT:nil,Bulk:40,QS:nil ,BEC:nil,COL:0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR:0,BRE:0,ARC:0 X-CID-BVR: 0,NGT X-CID-BAS: 0,NGT,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR,TF_CID_SPAM_FSD,TF_CID_SPAM_FSI X-UUID: 2d8da2ee738f11f0b29709d653e92f7d-20250807 X-User: liuqiqi@kylinos.cn Received: from localhost.localdomain [(223.70.159.239)] by mailgw.kylinos.cn (envelope-from ) (Generic MTA with TLSv1.3 TLS_AES_256_GCM_SHA384 256/256) with ESMTP id 1725618865; Thu, 07 Aug 2025 21:05:23 +0800 From: liuqiqi@kylinos.cn To: gregkh@linuxfoundation.org Cc: cve@kernel.org, linux-cve-announce@vger.kernel.org, linux-kernel@vger.kernel.org, liuqiqi Subject: CVE-2024-57884 patch review feedback (https://lore.kernel.org/linux-cve-announce/2025011510-CVE-2024-57884-4cf8@gregkh/#R) Date: Thu, 7 Aug 2025 21:05:15 +0800 Message-Id: <20250807130515.1445117-1-liuqiqi@kylinos.cn> X-Mailer: git-send-email 2.25.1 In-Reply-To: <2025011510-CVE-2024-57884-4cf8@gregkh> References: <2025011510-CVE-2024-57884-4cf8@gregkh> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" CVE-2024-57884 patch fixes mm: vmscan: account for free pages to prevent = infinite Loop in throttle_direct_reclaim() modify as follows @@ -342,7 +342,14 @@ unsigned long zone_reclaimable_pages(struct zone *zone) if (get_nr_swap_pages() > 0) nr +=3D zone_page_state_snapshot(zone, NR_ZONE_INACTIVE_ANON) + zone_page_state_snapshot(zone, NR_ZONE_ACTIVE_ANON); - + /* + * If there are no reclaimable file-backed or anonymous pages, + * ensure zones with sufficient free pages are not skipped. + * This prevents zones like DMA32 from being ignored in reclaim + * scenarios where they can still help alleviate memory pressure. + */ + if (nr =3D=3D 0) + nr =3D zone_page_state_snapshot(zone, NR_FREE_PAGES); return nr; } However, should_reclaim_retry() function calls zone_reclaimable_pages to co= unt free pages. When nr is 0, it double-counts NR_FREE_PAGES. This seems to= cause inaccurate page statistics, right? static inline bool should_reclaim_retry(gfp_t gfp_mask, unsigned order, struct alloc_context *ac, int alloc_flags, bool did_some_progress, int *no_progress_loops) { ...... available =3D reclaimable =3D zone_reclaimable_pages(zone); available +=3D zone_page_state_snapshot(zone, NR_FREE_PAGES); /* * Would the allocation succeed if we reclaimed all * reclaimable pages? */ wmark =3D __zone_watermark_ok(zone, order, min_wmark, ac->highest_zoneidx, alloc_flags, available); compaction_zonelist_suitable() function has the same problem. bool compaction_zonelist_suitable(struct alloc_context *ac, int order, int alloc_flags) { ...... available =3D zone_reclaimable_pages(zone) / order; available +=3D zone_page_state_snapshot(zone, NR_FREE_PAGES); if (__compaction_suitable(zone, order, min_wmark_pages(zone), ac->highest_zoneidx, available)) If this is problematic, can it be modified as follows: diff --git a/mm/vmscan.c b/mm/vmscan.c --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -6417,7 +6417,7 @@ static bool allow_direct_reclaim(pg_data_t *pgdat) return true; =20 for_each_managed_zone_pgdat(zone, pgdat, i, ZONE_NORMAL) { - if (!zone_reclaimable_pages(zone)) + if (!zone_reclaimable_pages(zone) || !(zone_page_state_snap= shot(zone, NR_FREE_PAGES))) continue; Signed-off-by: liuqiqi