[PATCH v2 1/1] mm: swap: remove duplicate nr_swap_pages decrement in get_swap_page_of_type()

[PATCH v2 1/1] mm: swap: remove duplicate nr_swap_pages decrement in get_swap_page_of_type()

[Youngjun Park]

After commit 4f78252da887, nr_swap_pages is decremented in
swap_range_alloc(). Since cluster_alloc_swap_entry() calls
swap_range_alloc() internally, the decrement in get_swap_page_of_type()
causes double-decrementing.

Remove the duplicate decrement.

Fixes: 4f78252da887 ("mm: swap: move nr_swap_pages counter decrement from folio_alloc_swap() to swap_range_alloc()")
Cc: stable@vger.kernel.org # v6.17-rc1
Signed-off-by: Youngjun Park <youngjun.park@lge.com>
Acked-by: Chris Li <chrisl@kernel.org>
Reviewed-by: Barry Song <baohua@kernel.org>
---
v1 -> v2:
 - Collect Acked-by from Chris - thank you!
 - Collect Reviewed-by from Barry - thank you!
 - Link to v1: https://lore.kernel.org/linux-mm/20251101134158.69908-1-youngjun.park@lge.com/

 mm/swapfile.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/mm/swapfile.c b/mm/swapfile.c
index 543f303f101d..66a502cd747b 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -2020,10 +2020,8 @@ swp_entry_t get_swap_page_of_type(int type)
 			local_lock(&percpu_swap_cluster.lock);
 			offset = cluster_alloc_swap_entry(si, 0, 1);
 			local_unlock(&percpu_swap_cluster.lock);
-			if (offset) {
+			if (offset)
 				entry = swp_entry(si->type, offset);
-				atomic_long_dec(&nr_swap_pages);
-			}
 		}
 		put_swap_device(si);
 	}
-- 
2.34.1

Re: [PATCH v2 1/1] mm: swap: remove duplicate nr_swap_pages decrement in get_swap_page_of_type()

[Kairui Song]

On Sun, Nov 2, 2025 at 4:36 PM Youngjun Park <youngjun.park@lge.com> wrote:
>
> After commit 4f78252da887, nr_swap_pages is decremented in
> swap_range_alloc(). Since cluster_alloc_swap_entry() calls
> swap_range_alloc() internally, the decrement in get_swap_page_of_type()
> causes double-decrementing.
>
> Remove the duplicate decrement.
>
> Fixes: 4f78252da887 ("mm: swap: move nr_swap_pages counter decrement from folio_alloc_swap() to swap_range_alloc()")
> Cc: stable@vger.kernel.org # v6.17-rc1
> Signed-off-by: Youngjun Park <youngjun.park@lge.com>
> Acked-by: Chris Li <chrisl@kernel.org>
> Reviewed-by: Barry Song <baohua@kernel.org>
> ---
> v1 -> v2:
>  - Collect Acked-by from Chris - thank you!
>  - Collect Reviewed-by from Barry - thank you!
>  - Link to v1: https://lore.kernel.org/linux-mm/20251101134158.69908-1-youngjun.park@lge.com/
>
>  mm/swapfile.c | 4 +---
>  1 file changed, 1 insertion(+), 3 deletions(-)
>
> diff --git a/mm/swapfile.c b/mm/swapfile.c
> index 543f303f101d..66a502cd747b 100644
> --- a/mm/swapfile.c
> +++ b/mm/swapfile.c
> @@ -2020,10 +2020,8 @@ swp_entry_t get_swap_page_of_type(int type)
>                         local_lock(&percpu_swap_cluster.lock);
>                         offset = cluster_alloc_swap_entry(si, 0, 1);
>                         local_unlock(&percpu_swap_cluster.lock);
> -                       if (offset) {
> +                       if (offset)
>                                 entry = swp_entry(si->type, offset);
> -                               atomic_long_dec(&nr_swap_pages);
> -                       }
>                 }
>                 put_swap_device(si);
>         }
> --
> 2.34.1

Thanks.

Reviewed-by: Kairui Song <kasong@tencent.com>

Re: [PATCH v2 1/1] mm: swap: remove duplicate nr_swap_pages decrement in get_swap_page_of_type()

[Andrew Morton]

On Sun,  2 Nov 2025 17:24:56 +0900 Youngjun Park <youngjun.park@lge.com> wrote:

> After commit 4f78252da887, nr_swap_pages is decremented in
> swap_range_alloc(). Since cluster_alloc_swap_entry() calls
> swap_range_alloc() internally, the decrement in get_swap_page_of_type()
> causes double-decrementing.
> 
> Remove the duplicate decrement.

Can we please have a description of the userspace-visible runtime
effects of the bug?

> Fixes: 4f78252da887 ("mm: swap: move nr_swap_pages counter decrement from folio_alloc_swap() to swap_range_alloc()")
> Cc: stable@vger.kernel.org # v6.17-rc1

Especially when proposing a backport.

Thanks.

Re: [PATCH v2 1/1] mm: swap: remove duplicate nr_swap_pages decrement in get_swap_page_of_type()

[YoungJun Park]

On Mon, Nov 03, 2025 at 06:56:08PM -0800, Andrew Morton wrote:
> On Sun,  2 Nov 2025 17:24:56 +0900 Youngjun Park <youngjun.park@lge.com> wrote:
> 
> > After commit 4f78252da887, nr_swap_pages is decremented in
> > swap_range_alloc(). Since cluster_alloc_swap_entry() calls
> > swap_range_alloc() internally, the decrement in get_swap_page_of_type()
> > causes double-decrementing.
> > 
> > Remove the duplicate decrement.
> 
> Can we please have a description of the userspace-visible runtime
> effects of the bug?
> > Fixes: 4f78252da887 ("mm: swap: move nr_swap_pages counter decrement from folio_alloc_swap() to swap_range_alloc()")
> > Cc: stable@vger.kernel.org # v6.17-rc1
> 
> Especially when proposing a backport.
> 
> Thanks.

Hi Andrew,

Thank you for picking up the patch. Since it's already in mm-hotfixes-unstable,
I'm providing the elaboration here rather than sending v3.

As a representative userspace-visible runtime example of the impact,
/proc/meminfo reports increasingly inaccurate SwapFree values. The
discrepancy grows with each swap allocation, and during hibernation when
large amounts of memory are written to swap, the reported value can deviate
significantly from actual available swap space, misleading users and
monitoring tools. 

Best Regards,
Youngjun

Re: [PATCH v2 1/1] mm: swap: remove duplicate nr_swap_pages decrement in get_swap_page_of_type()

[Nhat Pham]

On Sun, Nov 2, 2025 at 1:25 AM Youngjun Park <youngjun.park@lge.com> wrote:
>
> After commit 4f78252da887, nr_swap_pages is decremented in
> swap_range_alloc(). Since cluster_alloc_swap_entry() calls
> swap_range_alloc() internally, the decrement in get_swap_page_of_type()
> causes double-decrementing.
>
> Remove the duplicate decrement.
>
> Fixes: 4f78252da887 ("mm: swap: move nr_swap_pages counter decrement from folio_alloc_swap() to swap_range_alloc()")
> Cc: stable@vger.kernel.org # v6.17-rc1
> Signed-off-by: Youngjun Park <youngjun.park@lge.com>
> Acked-by: Chris Li <chrisl@kernel.org>
> Reviewed-by: Barry Song <baohua@kernel.org>

Acked-by: Nhat Pham <nphamcs@gmail.com>

Re: [PATCH v2 1/1] mm: swap: remove duplicate nr_swap_pages decrement in get_swap_page_of_type()

[Andrew Morton]

On Tue, 4 Nov 2025 23:46:40 +0900 YoungJun Park <youngjun.park@lge.com> wrote:

> > Can we please have a description of the userspace-visible runtime
> > effects of the bug?
> > > Fixes: 4f78252da887 ("mm: swap: move nr_swap_pages counter decrement from folio_alloc_swap() to swap_range_alloc()")
> > > Cc: stable@vger.kernel.org # v6.17-rc1
> > 
> > Especially when proposing a backport.
> > 
> > Thanks.
> 
> Hi Andrew,
> 
> Thank you for picking up the patch. Since it's already in mm-hotfixes-unstable,
> I'm providing the elaboration here rather than sending v3.
> 
> As a representative userspace-visible runtime example of the impact,
> /proc/meminfo reports increasingly inaccurate SwapFree values. The
> discrepancy grows with each swap allocation, and during hibernation when
> large amounts of memory are written to swap, the reported value can deviate
> significantly from actual available swap space, misleading users and
> monitoring tools. 

Great, thanks, very helpful.  I pasted that into the mm.git copy of
this patch.