Re: [PATCH 1/4] mm, swap: don't free a hibernation slot that is in the swap cache

[Kairui Song <ryncsn@gmail.com>]

On Sat, Aug 08, 2026 at 08:09:44PM +0800, Kairui Song wrote:
> On Fri, Aug 07, 2026 at 04:06:33AM +0800, Youngjun Park wrote:
> > A slot with a folio in the swap cache is freed when the folio leaves the
> > cache, not when its count drops.  swap_put_entries_cluster() follows that
> > rule.  swap_free_hibernation_slot() does not, it calls
> > __swap_cluster_free_entries() whether or not a folio sits on the slot.
> > 
> > Cluster readahead can put one there.  It walks a raw page_cluster sized
> > window of offsets around the faulting entry, and a hibernation slot passes
> > __swap_cache_add_check() because it is not a folio and its count is not
> > zero.  Freeing the slot then clears the entry under that folio.
> > 
> > The folio is now unreachable from the swap table, and the offset goes back
> > to the allocator.  The folio is still on the LRU though, so reclaim can
> > pick it up later.  It then takes the old offset out of folio->swap and
> > overwrites the table entry there, which by then may belong to someone else.
> > 
> > Check for a cached folio before freeing.  The slot is then left in the
> > ordinary state where only the swap cache holds it, and it is freed when the
> > folio leaves the cache, either through the reclaim below or through normal
> > reclaim later.
> > 
> > Fixes: 0d6af9bcf383 ("mm, swap: use the swap table to track the swap count")
> > Signed-off-by: Youngjun Park <youngjun.park@lge.com>
> > ---
> >  mm/swapfile.c | 9 ++++++++-
> >  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> Hi Youngjun,
> 
> Thanks a lot for looking into the hibernation issue, I've been thinking
> about using a exclusive type for it, glad to see actual code for it :)
> 
> And this patch looks good to me, nice catch!
> 
> Acked-by: Kairui Song <kasong@tencent.com>

Oh and I think we need to Cc stable?