[PATCH] scsi: ufs: core: Avoid possible memory reclaim deadlock in TX EQTR context

[PATCH] scsi: ufs: core: Avoid possible memory reclaim deadlock in TX EQTR context

[Can Guo]

TX EQTR may run while devfreq gear scaling has quiesced the UFS tagset. In
that context, functions ufshcd_tx_eqtr(), __ufshcd_tx_eqtr() and
ufs_qcom_get_rx_fom() allocate memory with GFP_KERNEL. If direct reclaim
is triggered, reclaim/writeback can depend on I/O to UFS device. Because
the queue is quiesced, this can cause deadlock.

Use GFP_NOIO for TX EQTR memory allocations:
- params->eqtr_record in ufshcd_tx_eqtr()
- eqtr_data in __ufshcd_tx_eqtr()
- params in ufs_qcom_get_rx_fom()

Fixes: 03e5d38e2f98 ("scsi: ufs: core: Add support for TX Equalization")
Closes: https://sashiko.dev/#/patchset/20260615132834.2985346-1-can.guo@oss.qualcomm.com?part=2
Signed-off-by: Can Guo <can.guo@oss.qualcomm.com>
---
 drivers/ufs/core/ufs-txeq.c | 4 ++--
 drivers/ufs/host/ufs-qcom.c | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/ufs/core/ufs-txeq.c b/drivers/ufs/core/ufs-txeq.c
index 4b264adfdf49..3a2fb5329d27 100644
--- a/drivers/ufs/core/ufs-txeq.c
+++ b/drivers/ufs/core/ufs-txeq.c
@@ -1059,7 +1059,7 @@ static int __ufshcd_tx_eqtr(struct ufs_hba *hba,
 			    struct ufs_pa_layer_attr *pwr_mode)
 {
 	struct ufshcd_tx_eqtr_data *eqtr_data  __free(kfree) =
-		kzalloc(sizeof(*eqtr_data), GFP_KERNEL);
+		kzalloc(sizeof(*eqtr_data), GFP_NOIO);
 	struct tx_eqtr_iter h_iter = {};
 	struct tx_eqtr_iter d_iter = {};
 	u32 gear = pwr_mode->gear_tx;
@@ -1217,7 +1217,7 @@ static int ufshcd_tx_eqtr(struct ufs_hba *hba,
 	if (!params->eqtr_record) {
 		params->eqtr_record = devm_kzalloc(hba->dev,
 						   sizeof(*params->eqtr_record),
-						   GFP_KERNEL);
+						   GFP_NOIO);
 		if (!params->eqtr_record)
 			return -ENOMEM;
 	}
diff --git a/drivers/ufs/host/ufs-qcom.c b/drivers/ufs/host/ufs-qcom.c
index c084ccc72523..e7f104987c6a 100644
--- a/drivers/ufs/host/ufs-qcom.c
+++ b/drivers/ufs/host/ufs-qcom.c
@@ -2760,7 +2760,7 @@ static int ufs_qcom_get_rx_fom(struct ufs_hba *hba,
 			       struct tx_eqtr_iter *d_iter)
 {
 	struct ufshcd_tx_eq_params *params __free(kfree) =
-		kzalloc(sizeof(*params), GFP_KERNEL);
+		kzalloc(sizeof(*params), GFP_NOIO);
 	struct ufs_qcom_host *host = ufshcd_get_variant(hba);
 	struct ufs_pa_layer_attr old_pwr_info;
 	u32 fom[PA_MAXDATALANES] = { 0 };
-- 
2.34.1

Re: [PATCH] scsi: ufs: core: Avoid possible memory reclaim deadlock in TX EQTR context

[Peter Wang (王信友)]

On Tue, 2026-06-16 at 02:06 -0700, Can Guo wrote:
> TX EQTR may run while devfreq gear scaling has quiesced the UFS
> tagset. In
> that context, functions ufshcd_tx_eqtr(), __ufshcd_tx_eqtr() and
> ufs_qcom_get_rx_fom() allocate memory with GFP_KERNEL. If direct
> reclaim
> is triggered, reclaim/writeback can depend on I/O to UFS device.
> Because
> the queue is quiesced, this can cause deadlock.
> 
> Use GFP_NOIO for TX EQTR memory allocations:
> - params->eqtr_record in ufshcd_tx_eqtr()
> - eqtr_data in __ufshcd_tx_eqtr()
> - params in ufs_qcom_get_rx_fom()
> 
> Fixes: 03e5d38e2f98 ("scsi: ufs: core: Add support for TX
> Equalization")
> Closes:
> https://urldefense.com/v3/__https://sashiko.dev/*/patchset/20260615132834.2985346-1-can.guo@oss.qualcomm.com?part=2__;Iw!!CTRNKA9wMg0ARbw!mkZe-Src0MPmBc2cQbRZtnVJptXP26uI7g0q9gx5ARTkkm9rC-F2eyWzO_fkKvjCDwwJh7a89OZHIGvcx_KbdwM$
> Signed-off-by: Can Guo <can.guo@oss.qualcomm.com>
> ---

Reviewed-by: Peter Wang <peter.wang@mediatek.com>

Re: [PATCH] scsi: ufs: core: Avoid possible memory reclaim deadlock in TX EQTR context

[Bart Van Assche]

On 6/16/26 2:06 AM, Can Guo wrote:
> diff --git a/drivers/ufs/core/ufs-txeq.c b/drivers/ufs/core/ufs-txeq.c
> index 4b264adfdf49..3a2fb5329d27 100644
> --- a/drivers/ufs/core/ufs-txeq.c
> +++ b/drivers/ufs/core/ufs-txeq.c
> @@ -1059,7 +1059,7 @@ static int __ufshcd_tx_eqtr(struct ufs_hba *hba,
>   			    struct ufs_pa_layer_attr *pwr_mode)
>   {
>   	struct ufshcd_tx_eqtr_data *eqtr_data  __free(kfree) =
> -		kzalloc(sizeof(*eqtr_data), GFP_KERNEL);
> +		kzalloc(sizeof(*eqtr_data), GFP_NOIO);
>   	struct tx_eqtr_iter h_iter = {};
>   	struct tx_eqtr_iter d_iter = {};
>   	u32 gear = pwr_mode->gear_tx;
> @@ -1217,7 +1217,7 @@ static int ufshcd_tx_eqtr(struct ufs_hba *hba,
>   	if (!params->eqtr_record) {
>   		params->eqtr_record = devm_kzalloc(hba->dev,
>   						   sizeof(*params->eqtr_record),
> -						   GFP_KERNEL);
> +						   GFP_NOIO);
>   		if (!params->eqtr_record)
>   			return -ENOMEM;
>   	}
> diff --git a/drivers/ufs/host/ufs-qcom.c b/drivers/ufs/host/ufs-qcom.c
> index c084ccc72523..e7f104987c6a 100644
> --- a/drivers/ufs/host/ufs-qcom.c
> +++ b/drivers/ufs/host/ufs-qcom.c
> @@ -2760,7 +2760,7 @@ static int ufs_qcom_get_rx_fom(struct ufs_hba *hba,
>   			       struct tx_eqtr_iter *d_iter)
>   {
>   	struct ufshcd_tx_eq_params *params __free(kfree) =
> -		kzalloc(sizeof(*params), GFP_KERNEL);
> +		kzalloc(sizeof(*params), GFP_NOIO);
>   	struct ufs_qcom_host *host = ufshcd_get_variant(hba);
>   	struct ufs_pa_layer_attr old_pwr_info;
>   	u32 fom[PA_MAXDATALANES] = { 0 };

Modifying individual memory allocation calls is error prone. The next
person who modifies this code may not be aware of this conversation and
might reintroduce a GFP_KERNEL allocation in the TX equalization code.

Please use memalloc_noio_save() and memalloc_noio_restore() instead of
changing GFP_KERNEL into GFP_NOIO. Additionally, please add a comment
above the memalloc_noio_save() call that explains why it is necessary.
See also https://docs.kernel.org/core-api/gfp_mask-from-fs-io.html.

Thanks,

Bart.

Re: [PATCH] scsi: ufs: core: Avoid possible memory reclaim deadlock in TX EQTR context

[Can Guo]

On 6/16/2026 9:31 PM, Bart Van Assche wrote:
> On 6/16/26 2:06 AM, Can Guo wrote:
>> diff --git a/drivers/ufs/core/ufs-txeq.c b/drivers/ufs/core/ufs-txeq.c
>> index 4b264adfdf49..3a2fb5329d27 100644
>> --- a/drivers/ufs/core/ufs-txeq.c
>> +++ b/drivers/ufs/core/ufs-txeq.c
>> @@ -1059,7 +1059,7 @@ static int __ufshcd_tx_eqtr(struct ufs_hba *hba,
>>                   struct ufs_pa_layer_attr *pwr_mode)
>>   {
>>       struct ufshcd_tx_eqtr_data *eqtr_data  __free(kfree) =
>> -        kzalloc(sizeof(*eqtr_data), GFP_KERNEL);
>> +        kzalloc(sizeof(*eqtr_data), GFP_NOIO);
>>       struct tx_eqtr_iter h_iter = {};
>>       struct tx_eqtr_iter d_iter = {};
>>       u32 gear = pwr_mode->gear_tx;
>> @@ -1217,7 +1217,7 @@ static int ufshcd_tx_eqtr(struct ufs_hba *hba,
>>       if (!params->eqtr_record) {
>>           params->eqtr_record = devm_kzalloc(hba->dev,
>>                              sizeof(*params->eqtr_record),
>> -                           GFP_KERNEL);
>> +                           GFP_NOIO);
>>           if (!params->eqtr_record)
>>               return -ENOMEM;
>>       }
>> diff --git a/drivers/ufs/host/ufs-qcom.c b/drivers/ufs/host/ufs-qcom.c
>> index c084ccc72523..e7f104987c6a 100644
>> --- a/drivers/ufs/host/ufs-qcom.c
>> +++ b/drivers/ufs/host/ufs-qcom.c
>> @@ -2760,7 +2760,7 @@ static int ufs_qcom_get_rx_fom(struct ufs_hba 
>> *hba,
>>                      struct tx_eqtr_iter *d_iter)
>>   {
>>       struct ufshcd_tx_eq_params *params __free(kfree) =
>> -        kzalloc(sizeof(*params), GFP_KERNEL);
>> +        kzalloc(sizeof(*params), GFP_NOIO);
>>       struct ufs_qcom_host *host = ufshcd_get_variant(hba);
>>       struct ufs_pa_layer_attr old_pwr_info;
>>       u32 fom[PA_MAXDATALANES] = { 0 };
>
> Modifying individual memory allocation calls is error prone. The next
> person who modifies this code may not be aware of this conversation and
> might reintroduce a GFP_KERNEL allocation in the TX equalization code.
>
> Please use memalloc_noio_save() and memalloc_noio_restore() instead of
> changing GFP_KERNEL into GFP_NOIO. Additionally, please add a comment
> above the memalloc_noio_save() call that explains why it is necessary.
> See also https://docs.kernel.org/core-api/gfp_mask-from-fs-io.html.
Thanks for the suggestion, using use memalloc_noio_save() and
memalloc_noio_restore() is indeed a better solution.

Best Regards,
Can Guo.
>
> Thanks,
>
> Bart.