Re: [PATCH v8 14/30] mm: zswap: reject high-order swap cache allocations backed by zswap

[Usama Arif <usama.arif@linux.dev>]

On Mon, 5 Oct 2026 13:18:24 -0700 Yosry Ahmed <yosry@kernel.org> wrote:

> On Fri, Oct 2, 2026 at 2:56 AM Usama Arif <usama.arif@linux.dev> wrote:
> >
> > zswap stores swapped-out pages one at a time, so a range of swap slots can
> > be split between zswap entries and the backing device. A high-order
> > swap-cache folio over such a range cannot be read back in one go: the disk
> > read would return stale or zero data for every slot zswap owns.
> >
> > Reject that in __swap_cache_alloc(). Do the check after the folio is in the
> > swap cache: from that point zswap can neither start storing nor start
> > writing back any slot in the range, so the answer is stable. Callers
> > already fall back to order-0, which zswap_load() handles per page.
> >
> > Export zswap_is_present() for the PMD-order swap-in users added later.
> >
> > Co-developed-by: Alexandre Ghiti <alex@ghiti.fr>
> > Signed-off-by: Alexandre Ghiti <alex@ghiti.fr>
> > Signed-off-by: Usama Arif <usama.arif@linux.dev>
> 
> Overall looks good, but I think it can be split into 3 patches (one of
> which doesn't have to be part of this series), see below.

Thanks for the review! I have followed your suggestion and split it into
3 patches now.

> 
> 
> 
> > ---
> >  include/linux/zswap.h |  6 ++++++
> >  mm/swap_state.c       | 39 +++++++++++++++++++++++++--------------
> >  mm/zswap.c            | 12 +++++++++---
> >  3 files changed, 40 insertions(+), 17 deletions(-)
> >
> > diff --git a/include/linux/zswap.h b/include/linux/zswap.h
> > index df6cafbe95dc0..94746fb71bb65 100644
> > --- a/include/linux/zswap.h
> > +++ b/include/linux/zswap.h
> > @@ -35,6 +35,7 @@ void zswap_lruvec_state_init(struct lruvec *lruvec);
> >  void zswap_folio_swapin(struct folio *folio);
> >  bool zswap_is_enabled(void);
> >  bool zswap_never_enabled(void);
> > +bool zswap_is_present(swp_entry_t entry, unsigned int nr);
> >  #else
> >
> >  struct zswap_lruvec_state {};
> > @@ -73,6 +74,11 @@ static inline bool zswap_never_enabled(void)
> >         return true;
> >  }
> >
> > +static inline bool zswap_is_present(swp_entry_t entry, unsigned int nr)
> > +{
> > +       return false;
> > +}
> > +
> >  #endif
> >
> >  #endif /* _LINUX_ZSWAP_H */
> > diff --git a/mm/swap_state.c b/mm/swap_state.c
> > index 625c185a1ca4d..251b48b2c60e1 100644
> > --- a/mm/swap_state.c
> > +++ b/mm/swap_state.c
> > @@ -12,6 +12,7 @@
> >  #include <linux/kernel_stat.h>
> >  #include <linux/mempolicy.h>
> >  #include <linux/swap.h>
> > +#include <linux/zswap.h>
> >  #include <linux/leafops.h>
> >  #include <linux/init.h>
> >  #include <linux/pagemap.h>
> > @@ -466,26 +467,27 @@ static struct folio *__swap_cache_alloc(struct swap_cluster_info *ci,
> >         __swap_cache_do_add_folio(ci, folio, entry);
> >         spin_unlock(&ci->lock);
> >
> > +       /*
> > +        * Now that the folio is in the swap cache, zswap can no longer start
> > +        * storing or writing back any slot in the range, so this is a stable
> > +        * answer. Reject a high-order allocation over a range that already
> > +        * has per-page zswap entries.
> > +        */
> > +       if (order && zswap_is_present(entry, nr_pages)) {
> > +               err = -EBUSY;
> > +               goto delete_folio;
> > +       }
> > +
> >         if (mem_cgroup_swapin_charge_folio(folio, memcg_id,
> >                                            vmf ? vmf->vma->vm_mm : NULL, gfp)) {
> > -               spin_lock(&ci->lock);
> > -               __swap_cache_do_del_folio(ci, folio, entry, shadow);
> > -               spin_unlock(&ci->lock);
> > -               folio_unlock(folio);
> > -               /* nr_pages refs from swap cache, 1 from allocation */
> > -               folio_put_refs(folio, nr_pages + 1);
> > +               err = -ENOMEM;
> >                 count_mthp_stat(order, MTHP_STAT_SWPIN_FALLBACK_CHARGE);
> > -               return ERR_PTR(-ENOMEM);
> > +               goto delete_folio;
> >         }
> >
> >         if (order > 1 && folio_memcg_alloc_deferred(folio)) {
> > -               spin_lock(&ci->lock);
> > -               __swap_cache_do_del_folio(ci, folio, entry, shadow);
> > -               spin_unlock(&ci->lock);
> > -               folio_unlock(folio);
> > -               /* nr_pages refs from swap cache, 1 from allocation */
> > -               folio_put_refs(folio, nr_pages + 1);
> > -               return ERR_PTR(-ENOMEM);
> > +               err = -ENOMEM;
> > +               goto delete_folio;
> >         }
> >
> >         /* memsw uncharges swap when folio is added to swap cache */
> > @@ -499,6 +501,15 @@ static struct folio *__swap_cache_alloc(struct swap_cluster_info *ci,
> >         /* Caller will initiate read into locked new_folio */
> >         folio_add_lru(folio);
> >         return folio;
> > +
> > +delete_folio:
> > +       spin_lock(&ci->lock);
> > +       __swap_cache_do_del_folio(ci, folio, entry, shadow);
> > +       spin_unlock(&ci->lock);
> > +       folio_unlock(folio);
> > +       /* nr_pages refs from swap cache, 1 from allocation */
> > +       folio_put_refs(folio, nr_pages + 1);
> > +       return ERR_PTR(err);
> 
> Nit: You can pull the refactoring into a separate patch (as well as
> most zswap changes, see below), so that this patch only has the
> logical change to bail for higher orders if any entry is in zswap.
> 
> >  }
> >
> >  /**
> > diff --git a/mm/zswap.c b/mm/zswap.c
> > index 507f2d19fd2a4..f5b5827d30084 100644
> > --- a/mm/zswap.c
> > +++ b/mm/zswap.c
> > @@ -1587,11 +1587,14 @@ bool zswap_store(struct folio *folio)
> >   * @entry: base swap entry of the range
> >   * @nr: number of contiguous slots to check
> >   *
> > - * Context: The caller must keep the range pinned, otherwise the answer can
> > - * change under it.
> > + * Context: Unless the caller keeps the range pinned, the answer is only a
> > + * hint: zswap can store or write back a slot right after this returns. A
> > + * caller that needs a stable answer must pin the range first, as
> > + * __swap_cache_alloc() does by inserting the folio into the swap cache before
> > + * asking.
> 
> I would rather avoid naming specific functions as it will go stale
> quickly, and instead list the ways of "pinning" a range.
> 
> Also, generally, the changes to mm/zswap.c seem orthogonal to this
> patch and can be a separate patch (which would be clearer if
> __swap_cache_alloc() isn't named here).
> 
> >   * Return: true if at least one slot in the range is in zswap.
> >   */
> > -static bool zswap_is_present(swp_entry_t entry, unsigned int nr)
> > +bool zswap_is_present(swp_entry_t entry, unsigned int nr)
> >  {
> >         pgoff_t offset = swp_offset(entry);
> >         struct xarray *tree = swap_zswap_tree(entry);
> > @@ -1605,6 +1608,9 @@ static bool zswap_is_present(swp_entry_t entry, unsigned int nr)
> >          */
> >         BUILD_BUG_ON(SWAPFILE_CLUSTER > ZSWAP_ADDRESS_SPACE_PAGES);
> >
> > +       if (zswap_never_enabled())
> > +               return false;
> > +
> >         return xa_find(tree, &index, offset + nr - 1, XA_PRESENT);
> >  }
> >
> > --
> > 2.53.0-Meta
> >
>