Re: [PATCH 1/4] mm, swap: don't free a hibernation slot that is in the swap cache

[Kairui Song <ryncsn@gmail.com>]

On Fri, Aug 07, 2026 at 04:06:33AM +0800, Youngjun Park wrote:
> A slot with a folio in the swap cache is freed when the folio leaves the
> cache, not when its count drops.  swap_put_entries_cluster() follows that
> rule.  swap_free_hibernation_slot() does not, it calls
> __swap_cluster_free_entries() whether or not a folio sits on the slot.
> 
> Cluster readahead can put one there.  It walks a raw page_cluster sized
> window of offsets around the faulting entry, and a hibernation slot passes
> __swap_cache_add_check() because it is not a folio and its count is not
> zero.  Freeing the slot then clears the entry under that folio.
> 
> The folio is now unreachable from the swap table, and the offset goes back
> to the allocator.  The folio is still on the LRU though, so reclaim can
> pick it up later.  It then takes the old offset out of folio->swap and
> overwrites the table entry there, which by then may belong to someone else.
> 
> Check for a cached folio before freeing.  The slot is then left in the
> ordinary state where only the swap cache holds it, and it is freed when the
> folio leaves the cache, either through the reclaim below or through normal
> reclaim later.
> 
> Fixes: 0d6af9bcf383 ("mm, swap: use the swap table to track the swap count")
> Signed-off-by: Youngjun Park <youngjun.park@lge.com>
> ---
>  mm/swapfile.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)

Hi Youngjun,

Thanks a lot for looking into the hibernation issue, I've been thinking
about using a exclusive type for it, glad to see actual code for it :)

And this patch looks good to me, nice catch!

Acked-by: Kairui Song <kasong@tencent.com>