On Sun, Aug 09, 2026 at 06:53:14PM +0200, Óscar Megía López wrote:
> I discovered an OOM after run the script below
> (I updated it and added a sleep to allow enough time for the cache to
> recover):
>
> while [ 1 -eq 1 ]; do\
> i=$((i+1)); echo 0000:00:01.0 > /sys/bus/pci/drivers/qxl/unbind;\
> if (($i%1000==0)); then\
> echo i=$i; free;\
> grep nr_free_pages /proc/vmstat;\
> grep -E "PageTables|VmallocUsed|Slab|Reclaimable" /proc/meminfo;\
> sync; echo 3 > /proc/sys/vm/drop_caches;\
> echo 1 > /proc/sys/vm/compact_memory;\
> sleep 10s;\
> free;\
> grep nr_free_pages /proc/vmstat;\
> grep -E "PageTables|VmallocUsed|Slab|Reclaimable" /proc/meminfo;\
> uptime;\
> fi;\
> echo 0000:00:01.0 > /sys/bus/pci/drivers/qxl/bind;\
> done
>
> The OOM isn't just a simple leak; it's a refcount corruption which renders
> the list_lru fix dead code after the first mid-init failure.
>
> Here's the chain:
>
> Bug 1: ttm_pool_type_init() does not check return from list_lru_init().
>
> Fix: Check the return value from list_lru_init() and propagate the error.
>
> Bug 2: ttm_pool_fini() does not destroy list lru with list_lru_destroy().
>
> Fix: Add list_lru_destroy() after ttm_pool_type_fini().
>
> Bug 3: ttm_pool_mgr_init() does not check ttm_pool_type_init() return
> and does not free pool if returns error.
>
> Fix: Move up shrinker_alloc(), check ttm_pool_type_init() return and free
> pool types and shrinker if non-zero and return error.
>
> Bug 4: ttm_pool_mgr_fini() does not destroy the list_lru.
>
> Fix: Add list_lru_destroy() after ttm_pool_type_fini().
>
> Fixed check for an empty shrinker_list.
Why is this not 4 different patches as part of a series?
> This patch depends on patch ("[PATCH v3] drm/qxl: fix use-after-free in
> qxl_irq_handler on PCI"), link [1] below.
That's not going to age well in a changelog text :(
thanks,
greg k-h
