From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mta0.migadu.com (out-28.mta0.migadu.com [91.218.175.28]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4F10E1D4606 for ; Mon, 21 Sep 2026 01:49:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.28 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789955373; cv=none; b=PNJPvvr5n+J/zWIPtm1jfIBPZPY5I+qKRrDsTK6ijQcnavVEIk2atsFysy/lftItvdO74h8jkDjxxT85uSm4DbMq/4pSNiS3De+0qBAOPugiiX7npijZ1HgNtg8vNFPcZV0tBspU2ZNTw88rFWOW/huq4QkoH67ntkMht9qMSdk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789955373; c=relaxed/simple; bh=Zq4+vW7gLIfMp6nL7BJFMjrgjpLWJuH9xpY0ZGtQq7c=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=o4Koz3DbLTGDbcN7ZHamoBVH4xiZSjmDzBvRaCG7xC9zaoKi4pD+2W1OZDu5fgOLiKaxKZsmFbG7T0rl9sfKvJI6QmpcQysrbVrCfkrZUvgqinxhOe9GlGUiPhwpqMwQhAMoylobl/WonmKW6Qf92o+CbPpYCBta547nnjdweuQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=esO4uJ5i; arc=none smtp.client-ip=91.218.175.28 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="esO4uJ5i" X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=Zq4+vW7gLIfMp6nL7BJFMjrgjpLWJuH9xpY0ZGtQq7c=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1789955368; v=1; x=1790560168; b=esO4uJ5iw7umAH0rRD2ZiT5bHTPjzNXsLXImfEbor4MRKFVkxG1lGMcQiIp1N5MugIVq/ODb A66p3fI5FSid+npcyPpBj78R+fhEaLZ4Eui6uOKODP45vzp5DurWAzq5wbwSJ+14mMywygij+6E ctv8Ern5wBS2FsQb9fDF+5rY= X-Envelope-To: linux-kernel@vger.kernel.org Received: by smtp.migadu.com with ESMTPS id 627428ec648c6623; Mon, 21 Sep 2026 01:49:28 +0000 X-Mizu-Trace-ID: 627428ec648c6623 X-Migadu-Flow: FLOW_OUT From: Qingfang Deng To: Miquel Raynal , Richard Weinberger , Vignesh Raghavendra , David Woodhouse , KOSAKI Motohiro , linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org Cc: Qingfang Deng , syzbot+e08e0a15269eefa87790@syzkaller.appspotmail.com Subject: [PATCH] mtd: block: prevent reclaim I/O during request processing Date: Mon, 21 Sep 2026 09:49:20 +0800 Message-ID: <20260921014921.78150-1-qingfang.deng@linux.dev> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The blktrans request callbacks run under dev->lock and may allocate memory with GFP_KERNEL. For example, mtdblock_writesect() uses vmalloc() to allocate its eraseblock cache. Direct reclaim can then recurse into block I/O and deadlock on resources held by the request being processed. syzbot reports a circular locking dependency involving the device mutex and fs_reclaim. Commit d5ba1c8ffd0b ("mtd: don't use PF_MEMALLOC") removed PF_MEMALLOC from the MTD request thread. That flag had prevented direct reclaim, so its removal made allocations during request processing eligible for reclaim without excluding I/O. Wrap request processing in mtd_queue_rq() in a NOIO scope. This covers both the request and background callbacks, including allocations made by lower MTD drivers, and prevents reclaim from initiating filesystem or block I/O. Fixes: d5ba1c8ffd0b ("mtd: don't use PF_MEMALLOC") Assisted-by: Codex:gpt-6-astra Reported-by: syzbot+e08e0a15269eefa87790@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=e08e0a15269eefa87790 Signed-off-by: Qingfang Deng --- drivers/mtd/mtd_blkdevs.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c index 4d2e7b7774e9..42f250344f0c 100644 --- a/drivers/mtd/mtd_blkdevs.c +++ b/drivers/mtd/mtd_blkdevs.c @@ -18,6 +18,7 @@ #include #include #include +#include #include #include "mtdcore.h" @@ -167,6 +168,7 @@ static blk_status_t mtd_queue_rq(struct blk_mq_hw_ctx *hctx, const struct blk_mq_queue_data *bd) { struct mtd_blktrans_dev *dev; + unsigned int noio_flags; dev = hctx->queue->queuedata; if (!dev) { @@ -174,10 +176,13 @@ static blk_status_t mtd_queue_rq(struct blk_mq_hw_ctx *hctx, return BLK_STS_IOERR; } + /* Reclaim must not recurse into I/O while processing requests. */ + noio_flags = memalloc_noio_save(); spin_lock_irq(&dev->queue_lock); list_add_tail(&bd->rq->queuelist, &dev->rq_list); mtd_blktrans_work(dev); spin_unlock_irq(&dev->queue_lock); + memalloc_noio_restore(noio_flags); return BLK_STS_OK; } -- 2.43.0