mm: slub: avoid wake up kswapd in set_track_prepare

JIRA: https://issues.redhat.com/browse/RHEL-125520
CVE: CVE-2025-39843

This patch is a backport of the following upstream commit:
commit 850470a
Author: yangshiguang <yangshiguang@xiaomi.com>
Date:   Sat Aug 30 10:09:46 2025 +0800

    mm: slub: avoid wake up kswapd in set_track_prepare

    set_track_prepare() can incur lock recursion.
    The issue is that it is called from hrtimer_start_range_ns
    holding the per_cpu(hrtimer_bases)[n].lock, but when enabled
    CONFIG_DEBUG_OBJECTS_TIMERS, may wake up kswapd in set_track_prepare,
    and try to hold the per_cpu(hrtimer_bases)[n].lock.

    Avoid deadlock caused by implicitly waking up kswapd by passing in
    allocation flags, which do not contain __GFP_KSWAPD_RECLAIM in the
    debug_objects_fill_pool() case. Inside stack depot they are processed by
    gfp_nested_mask().
    Since ___slab_alloc() has preemption disabled, we mask out
    __GFP_DIRECT_RECLAIM from the flags there.

    The oops looks something like:

    BUG: spinlock recursion on CPU#3, swapper/3/0
     lock: 0xffffff8a4bf29c80, .magic: dead4ead, .owner: swapper/3/0, .owner_cpu: 3
    Hardware name: Qualcomm Technologies, Inc. Popsicle based on SM8850 (DT)
    Call trace:
    spin_bug+0x0
    _raw_spin_lock_irqsave+0x80
    hrtimer_try_to_cancel+0x94
    task_contending+0x10c
    enqueue_dl_entity+0x2a4
    dl_server_start+0x74
    enqueue_task_fair+0x568
    enqueue_task+0xac
    do_activate_task+0x14c
    ttwu_do_activate+0xcc
    try_to_wake_up+0x6c8
    default_wake_function+0x20
    autoremove_wake_function+0x1c
    __wake_up+0xac
    wakeup_kswapd+0x19c
    wake_all_kswapds+0x78
    __alloc_pages_slowpath+0x1ac
    __alloc_pages_noprof+0x298
    stack_depot_save_flags+0x6b0
    stack_depot_save+0x14
    set_track_prepare+0x5c
    ___slab_alloc+0xccc
    __kmalloc_cache_noprof+0x470
    __set_page_owner+0x2bc
    post_alloc_hook[jt]+0x1b8
    prep_new_page+0x28
    get_page_from_freelist+0x1edc
    __alloc_pages_noprof+0x13c
    alloc_slab_page+0x244
    allocate_slab+0x7c
    ___slab_alloc+0x8e8
    kmem_cache_alloc_noprof+0x450
    debug_objects_fill_pool+0x22c
    debug_object_activate+0x40
    enqueue_hrtimer[jt]+0xdc
    hrtimer_start_range_ns+0x5f8
    ...

    Signed-off-by: yangshiguang <yangshiguang@xiaomi.com>
    Fixes: 5cf909c ("mm/slub: use stackdepot to save stack trace in objects")
    Cc: stable@vger.kernel.org
    Signed-off-by: Vlastimil Babka <vbabka@suse.cz>

Signed-off-by: Audra Mitchell <audra@redhat.com>

Author: Audra Mitchell

mm/slub.c

@@ -897,19 +897,19 @@ static struct track *get_track(struct kmem_cache *s, void *object,
 }
 
 #ifdef CONFIG_STACKDEPOT
-static noinline depot_stack_handle_t set_track_prepare(void)
+static noinline depot_stack_handle_t set_track_prepare(gfp_t gfp_flags)
 {
 	depot_stack_handle_t handle;
 	unsigned long entries[TRACK_ADDRS_COUNT];
 	unsigned int nr_entries;
 
 	nr_entries = stack_trace_save(entries, ARRAY_SIZE(entries), 3);
-	handle = stack_depot_save(entries, nr_entries, GFP_NOWAIT);
+	handle = stack_depot_save(entries, nr_entries, gfp_flags);
 
 	return handle;
 }
 #else
-static inline depot_stack_handle_t set_track_prepare(void)
+static inline depot_stack_handle_t set_track_prepare(gfp_t gfp_flags)
 {
 	return 0;
 }
@@ -931,9 +931,9 @@ static void set_track_update(struct kmem_cache *s, void *object,
 }
 
 static __always_inline void set_track(struct kmem_cache *s, void *object,
-				      enum track_item alloc, unsigned long addr)
+				      enum track_item alloc, unsigned long addr, gfp_t gfp_flags)
 {
-	depot_stack_handle_t handle = set_track_prepare();
+	depot_stack_handle_t handle = set_track_prepare(gfp_flags);
 
 	set_track_update(s, object, alloc, addr, handle);
 }
@@ -1826,9 +1826,9 @@ static inline bool free_debug_processing(struct kmem_cache *s,
 static inline void slab_pad_check(struct kmem_cache *s, struct slab *slab) {}
 static inline int check_object(struct kmem_cache *s, struct slab *slab,
 			void *object, u8 val) { return 1; }
-static inline depot_stack_handle_t set_track_prepare(void) { return 0; }
+static inline depot_stack_handle_t set_track_prepare(gfp_t gfp_flags) { return 0; }
 static inline void set_track(struct kmem_cache *s, void *object,
-			     enum track_item alloc, unsigned long addr) {}
+			     enum track_item alloc, unsigned long addr, gfp_t gfp_flags) {}
 static inline void add_full(struct kmem_cache *s, struct kmem_cache_node *n,
 					struct slab *slab) {}
 static inline void remove_full(struct kmem_cache *s, struct kmem_cache_node *n,
@@ -3520,9 +3520,14 @@ static void *___slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node,
 			 * For debug caches here we had to go through
 			 * alloc_single_from_partial() so just store the
 			 * tracking info and return the object.
+			 *
+			 * Due to disabled preemption we need to disallow
+			 * blocking. The flags are further adjusted by
+			 * gfp_nested_mask() in stack_depot itself.
 			 */
 			if (s->flags & SLAB_STORE_USER)
-				set_track(s, freelist, TRACK_ALLOC, addr);
+				set_track(s, freelist, TRACK_ALLOC, addr,
+					  gfpflags & ~(__GFP_DIRECT_RECLAIM));
 
 			return freelist;
 		}
@@ -3548,7 +3553,8 @@ static void *___slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node,
 			goto new_objects;
 
 		if (s->flags & SLAB_STORE_USER)
-			set_track(s, freelist, TRACK_ALLOC, addr);
+			set_track(s, freelist, TRACK_ALLOC, addr,
+				  gfpflags & ~(__GFP_DIRECT_RECLAIM));
 
 		return freelist;
 	}
@@ -4026,8 +4032,12 @@ static noinline void free_to_partial_list(
 	unsigned long flags;
 	depot_stack_handle_t handle = 0;
 
+	/*
+	 * We cannot use GFP_NOWAIT as there are callsites where waking up
+	 * kswapd could deadlock
+	 */
 	if (s->flags & SLAB_STORE_USER)
-		handle = set_track_prepare();
+		handle = set_track_prepare(__GFP_NOWARN);
 
 	spin_lock_irqsave(&n->list_lock, flags);