[PATCH 0/3] mm, swap: don't spin or flood the console on a bad swap entry

[PATCH 0/3] mm, swap: don't spin or flood the console on a bad swap entry

[Breno Leitao]

I've seen some machines at Meta flete that show the following type of
problem:

1) It gets some weird warning:

  BUG: Bad page map in process khugepaged  pte:f000eef300000017 pmd:00000067
  addr:00007f57c0a01000 vm_flags:20200073 anon_vma:ffff88829af7c340 mapping:0000000000000000 index:7f57c0a01

The corruption is most likely the collapse/PT_RECLAIM race fixed by
commit 366a4532d96f ("mm: fix the race between collapse and PT_RECLAIM
under per-vma lock"). But this series is not about tha.

2) Then it floods all the monitoring of the fleet, sending the same
   message in the loop, crashing the our fleet kernel monitoring
   subsystem (which is the part that I am interested in protecting)

  get_swap_device: Bad swap offset entry 3ffffffc043c5

For instance, in a host today it logged 6M in a few hours, and it is still
going forever. Two things go wrong.

1) get_swap_device() prints unconditionally, unlike print_bad_pte() next
   door which suppresses itself with is_bad_page_map_ratelimited().

1) do_swap_page() returns 0 when get_swap_device() fails, so the
   fault is retried, reads the same entry and faults again.
   Nothing in the round trip changes the PTE.

Trying to fix it in a naive way:

Patch 1 is super simple, and rate limits the two prints.

Patch 2 makes get_swap_device() return ERR_PTR(-EINVAL) for an entry
that can never name a slot on any device, keeping NULL for a device
swapoff is taking away, and converts the callers. No functional change
expected.

Patch 3 uses that to return VM_FAULT_SIGBUS instead of retrying.

---
Breno Leitao (3):
      mm, swap: ratelimit bad swap entry reports in get_swap_device()
      mm, swap: distinguish a malformed swap entry from a dying device
      mm: fail the fault on a malformed swap entry instead of retrying it

 mm/memory.c      |  7 ++++++-
 mm/mincore.c     |  2 +-
 mm/shmem.c       |  2 +-
 mm/swap_state.c  |  4 ++--
 mm/swapfile.c    | 17 ++++++++++-------
 mm/userfaultfd.c |  3 ++-
 mm/zswap.c       |  2 +-
 7 files changed, 23 insertions(+), 14 deletions(-)
---
base-commit: 6b8c8af514d739d0335f5579b585e02babe8a727
change-id: 20260810-swap-25420f9c8ba9

Best regards,
--  
Breno Leitao <leitao@debian.org>

[PATCH 1/3] mm, swap: ratelimit bad swap entry reports in get_swap_device()

[Breno Leitao]

A corrupt page table hands the same bogus entry to get_swap_device() on
every access to the mapping, and every rejection is logged. One machine
logged 6185620 copies of the same line in a few hours.

Rate limit both prints.

Signed-off-by: Breno Leitao <leitao@debian.org>
---
 mm/swapfile.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/mm/swapfile.c b/mm/swapfile.c
index 4d4e3e3059f6b..9ab11dc24e4f1 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -1899,11 +1899,11 @@ struct swap_info_struct *get_swap_device(swp_entry_t entry)
 
 	return si;
 bad_nofile:
-	pr_err("%s: %s%08lx\n", __func__, Bad_file, entry.val);
+	pr_err_ratelimited("%s: %s%08lx\n", __func__, Bad_file, entry.val);
 out:
 	return NULL;
 put_out:
-	pr_err("%s: %s%08lx\n", __func__, Bad_offset, entry.val);
+	pr_err_ratelimited("%s: %s%08lx\n", __func__, Bad_offset, entry.val);
 	percpu_ref_put(&si->users);
 	return NULL;
 }

-- 
2.53.0-Meta

Re: [PATCH 1/3] mm, swap: ratelimit bad swap entry reports in get_swap_device()

[David Hildenbrand (Arm)]

On 8/10/26 18:26, Breno Leitao wrote:
> A corrupt page table hands the same bogus entry to get_swap_device() on
> every access to the mapping, and every rejection is logged. One machine
> logged 6185620 copies of the same line in a few hours.
> 
> Rate limit both prints.
> 
> Signed-off-by: Breno Leitao <leitao@debian.org>
> ---
>  mm/swapfile.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/mm/swapfile.c b/mm/swapfile.c
> index 4d4e3e3059f6b..9ab11dc24e4f1 100644
> --- a/mm/swapfile.c
> +++ b/mm/swapfile.c
> @@ -1899,11 +1899,11 @@ struct swap_info_struct *get_swap_device(swp_entry_t entry)
>  
>  	return si;
>  bad_nofile:
> -	pr_err("%s: %s%08lx\n", __func__, Bad_file, entry.val);
> +	pr_err_ratelimited("%s: %s%08lx\n", __func__, Bad_file, entry.val);
>  out:
>  	return NULL;
>  put_out:
> -	pr_err("%s: %s%08lx\n", __func__, Bad_offset, entry.val);
> +	pr_err_ratelimited("%s: %s%08lx\n", __func__, Bad_offset, entry.val);
>  	percpu_ref_put(&si->users);
>  	return NULL;
>  }
> 

In print_bad_page_map() we use something more advanced
(is_bad_page_map_ratelimited): essentially a burst of 60 followed by 1minute of
silence.

Couldn't some of the stuff you drop here (different entries) be similarly valuable?

-- 
Cheers,

David

Re: [PATCH 1/3] mm, swap: ratelimit bad swap entry reports in get_swap_device()

[Pedro Falcato]

On Tue, Aug 11, 2026 at 05:33:54PM +0200, David Hildenbrand (Arm) wrote:
> On 8/10/26 18:26, Breno Leitao wrote:
> > A corrupt page table hands the same bogus entry to get_swap_device() on
> > every access to the mapping, and every rejection is logged. One machine
> > logged 6185620 copies of the same line in a few hours.
> > 
> > Rate limit both prints.
> > 
> > Signed-off-by: Breno Leitao <leitao@debian.org>
> > ---
> >  mm/swapfile.c | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> > 
> > diff --git a/mm/swapfile.c b/mm/swapfile.c
> > index 4d4e3e3059f6b..9ab11dc24e4f1 100644
> > --- a/mm/swapfile.c
> > +++ b/mm/swapfile.c
> > @@ -1899,11 +1899,11 @@ struct swap_info_struct *get_swap_device(swp_entry_t entry)
> >  
> >  	return si;
> >  bad_nofile:
> > -	pr_err("%s: %s%08lx\n", __func__, Bad_file, entry.val);
> > +	pr_err_ratelimited("%s: %s%08lx\n", __func__, Bad_file, entry.val);
> >  out:
> >  	return NULL;
> >  put_out:
> > -	pr_err("%s: %s%08lx\n", __func__, Bad_offset, entry.val);
> > +	pr_err_ratelimited("%s: %s%08lx\n", __func__, Bad_offset, entry.val);
> >  	percpu_ref_put(&si->users);
> >  	return NULL;
> >  }
> > 
> 
> In print_bad_page_map() we use something more advanced
> (is_bad_page_map_ratelimited): essentially a burst of 60 followed by 1minute of
> silence.

Is it more advanced? It just looks like a handcoded version of __ratelimit.

... I hate it now. I'll send a patch I guess.
 
> Couldn't some of the stuff you drop here (different entries) be similarly valuable?

I think we generally do a terribly lousy job reporting these kinds of
failures. Would be awesome to log this elsewhere, or possibly send
something like a SIGBUS to the faulting process, for instance.

(and this kind of stuff should very much be handleable by userspace,
otherwise programs can drop data without even finding out about it)


-- 
Pedro

Re: [PATCH 1/3] mm, swap: ratelimit bad swap entry reports in get_swap_device()

[Breno Leitao]

On Tue, Aug 11, 2026 at 05:48:52PM +0100, Pedro Falcato wrote:
> > Couldn't some of the stuff you drop here (different entries) be similarly valuable?
>
> I think we generally do a terribly lousy job reporting these kinds of
> failures. Would be awesome to log this elsewhere, or possibly send
> something like a SIGBUS to the faulting process, for instance.

That's precisely what the follow-up patch in this series handles.

Patch "[PATCH 3/3] mm: fail the fault on a malformed swap entry instead of
retrying it" propagates VM_FAULT_SIGBUS all the way up, so the
application gets SIGBUS'd instead of retrying (and re-printing this
message).

Re: [PATCH 1/3] mm, swap: ratelimit bad swap entry reports in get_swap_device()

[David Hildenbrand (Arm)]

On 8/11/26 18:48, Pedro Falcato wrote:
> On Tue, Aug 11, 2026 at 05:33:54PM +0200, David Hildenbrand (Arm) wrote:
>> On 8/10/26 18:26, Breno Leitao wrote:
>>> A corrupt page table hands the same bogus entry to get_swap_device() on
>>> every access to the mapping, and every rejection is logged. One machine
>>> logged 6185620 copies of the same line in a few hours.
>>>
>>> Rate limit both prints.
>>>
>>> Signed-off-by: Breno Leitao <leitao@debian.org>
>>> ---
>>>  mm/swapfile.c | 4 ++--
>>>  1 file changed, 2 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/mm/swapfile.c b/mm/swapfile.c
>>> index 4d4e3e3059f6b..9ab11dc24e4f1 100644
>>> --- a/mm/swapfile.c
>>> +++ b/mm/swapfile.c
>>> @@ -1899,11 +1899,11 @@ struct swap_info_struct *get_swap_device(swp_entry_t entry)
>>>  
>>>  	return si;
>>>  bad_nofile:
>>> -	pr_err("%s: %s%08lx\n", __func__, Bad_file, entry.val);
>>> +	pr_err_ratelimited("%s: %s%08lx\n", __func__, Bad_file, entry.val);
>>>  out:
>>>  	return NULL;
>>>  put_out:
>>> -	pr_err("%s: %s%08lx\n", __func__, Bad_offset, entry.val);
>>> +	pr_err_ratelimited("%s: %s%08lx\n", __func__, Bad_offset, entry.val);
>>>  	percpu_ref_put(&si->users);
>>>  	return NULL;
>>>  }
>>>
>>
>> In print_bad_page_map() we use something more advanced
>> (is_bad_page_map_ratelimited): essentially a burst of 60 followed by 1minute of
>> silence.
> 
> Is it more advanced? It just looks like a handcoded version of __ratelimit.
> 
> ... I hate it now. I'll send a patch I guess.

Thanks for cleaning that up!

-- 
Cheers,

David

[PATCH 2/3] mm, swap: distinguish a malformed swap entry from a dying device

[Breno Leitao]

get_swap_device() returns NULL both for an entry that can never name a
slot on any device and for a device that swapoff is taking away. The
first never becomes valid, the second does, and callers cannot tell
them apart.

Return ERR_PTR(-EINVAL) for the two malformed cases and keep NULL for
swapoff. Callers bail out on failure either way, so switch them to
IS_ERR_OR_NULL() and clear si where the cleanup path would otherwise
put an ERR_PTR. No functional change.

Signed-off-by: Breno Leitao <leitao@debian.org>
---
 mm/memory.c      |  4 +++-
 mm/mincore.c     |  2 +-
 mm/shmem.c       |  2 +-
 mm/swap_state.c  |  4 ++--
 mm/swapfile.c    | 13 ++++++++-----
 mm/userfaultfd.c |  3 ++-
 mm/zswap.c       |  2 +-
 7 files changed, 18 insertions(+), 12 deletions(-)

diff --git a/mm/memory.c b/mm/memory.c
index d9cf941967cf0..4238778b66c42 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -4956,8 +4956,10 @@ vm_fault_t do_swap_page(struct vm_fault *vmf)
 
 	/* Prevent swapoff from happening to us. */
 	si = get_swap_device(entry);
-	if (unlikely(!si))
+	if (IS_ERR_OR_NULL(si)) {
+		si = NULL;
 		goto out;
+	}
 
 	folio = swap_cache_get_folio(entry);
 	if (folio)
diff --git a/mm/mincore.c b/mm/mincore.c
index ff4ac82817683..c086836bc4bcc 100644
--- a/mm/mincore.c
+++ b/mm/mincore.c
@@ -71,7 +71,7 @@ static unsigned char mincore_swap(swp_entry_t entry, bool shmem)
 	 */
 	if (shmem) {
 		si = get_swap_device(entry);
-		if (!si)
+		if (IS_ERR_OR_NULL(si))
 			return 0;
 	}
 	folio = swap_cache_get_folio(entry);
diff --git a/mm/shmem.c b/mm/shmem.c
index 65572cbf1bd3c..d0a9f52bfed71 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -2276,7 +2276,7 @@ static int shmem_swapin_folio(struct inode *inode, pgoff_t index,
 
 	si = get_swap_device(index_entry);
 	order = shmem_confirm_swap(mapping, index, index_entry);
-	if (unlikely(!si)) {
+	if (IS_ERR_OR_NULL(si)) {
 		if (order < 0)
 			return -EEXIST;
 		else
diff --git a/mm/swap_state.c b/mm/swap_state.c
index 4b7a3303c463b..f2e86d6626ecc 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -715,7 +715,7 @@ struct folio *read_swap_cache_async(struct swap_io_ctx *ctx, swp_entry_t entry,
 	struct folio *folio;
 
 	si = get_swap_device(entry);
-	if (!si)
+	if (IS_ERR_OR_NULL(si))
 		return NULL;
 
 	mpol = get_vma_policy(vma, addr, 0, &ilx);
@@ -951,7 +951,7 @@ static struct folio *swap_vma_readahead(swp_entry_t targ_entry, gfp_t gfp_mask,
 		 */
 		if (swp_type(entry) != swp_type(targ_entry)) {
 			si = get_swap_device(entry);
-			if (!si)
+			if (IS_ERR_OR_NULL(si))
 				continue;
 		}
 		folio = swap_cache_read_folio(&ctx, entry, gfp_mask, mpol, ilx,
diff --git a/mm/swapfile.c b/mm/swapfile.c
index 9ab11dc24e4f1..29612a0cf7afa 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -1504,7 +1504,7 @@ int swap_retry_table_alloc(swp_entry_t entry, gfp_t gfp)
 	unsigned long offset = swp_offset(entry);
 
 	si = get_swap_device(entry);
-	if (!si)
+	if (IS_ERR_OR_NULL(si))
 		return 0;
 
 	ci = __swap_offset_to_cluster(si, offset);
@@ -1859,7 +1859,9 @@ void folio_put_swap(struct folio *folio, struct page *page)
  * Check whether swap entry is valid in the swap device.  If so,
  * return pointer to swap_info_struct, and keep the swap entry valid
  * via preventing the swap device from being swapoff, until
- * put_swap_device() is called.  Otherwise return NULL.
+ * put_swap_device() is called.  Return NULL for an empty entry or a
+ * device that is going away, and ERR_PTR(-EINVAL) if the entry itself
+ * is malformed and can never name a slot on any device.
  *
  * Notice that swapoff or swapoff+swapon can still happen before the
  * percpu_ref_tryget_live() in get_swap_device() or after the
@@ -1900,12 +1902,13 @@ struct swap_info_struct *get_swap_device(swp_entry_t entry)
 	return si;
 bad_nofile:
 	pr_err_ratelimited("%s: %s%08lx\n", __func__, Bad_file, entry.val);
+	return ERR_PTR(-EINVAL);
 out:
 	return NULL;
 put_out:
 	pr_err_ratelimited("%s: %s%08lx\n", __func__, Bad_offset, entry.val);
 	percpu_ref_put(&si->users);
-	return NULL;
+	return ERR_PTR(-EINVAL);
 }
 
 /*
@@ -2001,7 +2004,7 @@ int swp_swapcount(swp_entry_t entry)
 	int count;
 
 	si = get_swap_device(entry);
-	if (!si)
+	if (IS_ERR_OR_NULL(si))
 		return 0;
 
 	ci = swap_cluster_lock(si, swp_offset(entry));
@@ -2127,7 +2130,7 @@ void swap_put_entries_direct(swp_entry_t entry, int nr)
 	struct swap_info_struct *si;
 
 	si = get_swap_device(entry);
-	if (WARN_ON_ONCE(!si))
+	if (WARN_ON_ONCE(IS_ERR_OR_NULL(si)))
 		return;
 	if (WARN_ON_ONCE(end_offset > si->max))
 		goto out;
diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
index 24a4d92ffa3c2..bf7bc7fb1aa0f 100644
--- a/mm/userfaultfd.c
+++ b/mm/userfaultfd.c
@@ -1700,7 +1700,8 @@ static long move_pages_ptes(struct mm_struct *mm, pmd_t *dst_pmd, pmd_t *src_pmd
 		}
 
 		si = get_swap_device(entry);
-		if (unlikely(!si)) {
+		if (IS_ERR_OR_NULL(si)) {
+			si = NULL;
 			ret = -EAGAIN;
 			goto out;
 		}
diff --git a/mm/zswap.c b/mm/zswap.c
index f7c9c89f6449c..bc9b931d6f447 100644
--- a/mm/zswap.c
+++ b/mm/zswap.c
@@ -997,7 +997,7 @@ static int zswap_writeback_entry(struct zswap_entry *entry,
 
 	/* try to allocate swap cache folio */
 	si = get_swap_device(swpentry);
-	if (!si)
+	if (IS_ERR_OR_NULL(si))
 		return -EEXIST;
 
 	mpol = get_task_policy(current);

-- 
2.53.0-Meta

Re: [PATCH 2/3] mm, swap: distinguish a malformed swap entry from a dying device

[David Hildenbrand (Arm)]

On 8/10/26 18:26, Breno Leitao wrote:
> get_swap_device() returns NULL both for an entry that can never name a

"an entry that can never name a slot on any device" is confusing. Can you elaborate?

> slot on any device and for a device that swapoff is taking away. The
> first never becomes valid, the second does, and callers cannot tell
> them apart.
> 
> Return ERR_PTR(-EINVAL) for the two malformed cases and keep NULL for
> swapoff. Callers bail out on failure either way, so switch them to
> IS_ERR_OR_NULL() and clear si where the cleanup path would otherwise
> put an ERR_PTR. No functional change.
> 

[...]

>  	ci = __swap_offset_to_cluster(si, offset);
> @@ -1859,7 +1859,9 @@ void folio_put_swap(struct folio *folio, struct page *page)
>   * Check whether swap entry is valid in the swap device.  If so,
>   * return pointer to swap_info_struct, and keep the swap entry valid
>   * via preventing the swap device from being swapoff, until
> - * put_swap_device() is called.  Otherwise return NULL.
> + * put_swap_device() is called.  Return NULL for an empty entry or a
> + * device that is going away, and ERR_PTR(-EINVAL) if the entry itself
> + * is malformed and can never name a slot on any device.
>   *
>   * Notice that swapoff or swapoff+swapon can still happen before the
>   * percpu_ref_tryget_live() in get_swap_device() or after the
> @@ -1900,12 +1902,13 @@ struct swap_info_struct *get_swap_device(swp_entry_t entry)
>  	return si;
>  bad_nofile:
>  	pr_err_ratelimited("%s: %s%08lx\n", __func__, Bad_file, entry.val);
> +	return ERR_PTR(-EINVAL);
>  out:
>  	return NULL;
>  put_out:
>  	pr_err_ratelimited("%s: %s%08lx\n", __func__, Bad_offset, entry.val);
>  	percpu_ref_put(&si->users);
> -	return NULL;
> +	return ERR_PTR(-EINVAL);
>  }
Is -EINVAL really the logical right return value? Running into bad swap entries
sounds more serious to me than "-EINVAL" :)

-- 
Cheers,

David

Re: [PATCH 2/3] mm, swap: distinguish a malformed swap entry from a dying device

[Breno Leitao]

Hello David,

On Tue, Aug 11, 2026 at 05:36:31PM +0200, David Hildenbrand (Arm) wrote:
> On 8/10/26 18:26, Breno Leitao wrote:
> > +	return ERR_PTR(-EINVAL);
> >  }
>
> Is -EINVAL really the logical right return value? Running into bad swap entries
> sounds more serious to me than "-EINVAL" :)

Good point, maybe we need a strong drug here, what about -EIO?

I picked -EINVAL because it is what the swap code already returns for
this exact condition. 


	* Returns -EINVAL if the swap entry is invalid, which might
	* occur if a page table entry has got corrupted.
	*/
	int swap_dup_entry_direct(swp_entry_t entry)
	{
		si = swap_entry_to_info(entry);
		if (WARN_ON_ONCE(!si)) {
			pr_err("%s%08lx\n", Bad_file, entry.val);
			return -EINVAL;

But, I do agree -EINVAL is too soft given the situation we are in.

I will return -EIO in the next version, if I don't hear any concern.

Re: [PATCH 2/3] mm, swap: distinguish a malformed swap entry from a dying device

[David Hildenbrand (Arm)]

On 8/12/26 12:48, Breno Leitao wrote:
> Hello David,
> 
> On Tue, Aug 11, 2026 at 05:36:31PM +0200, David Hildenbrand (Arm) wrote:
>> On 8/10/26 18:26, Breno Leitao wrote:
>>> +	return ERR_PTR(-EINVAL);
>>>  }
>>
>> Is -EINVAL really the logical right return value? Running into bad swap entries
>> sounds more serious to me than "-EINVAL" :)
> 
> Good point, maybe we need a strong drug here, what about -EIO?
> 
> I picked -EINVAL because it is what the swap code already returns for
> this exact condition. 
> 
> 
> 	* Returns -EINVAL if the swap entry is invalid, which might
> 	* occur if a page table entry has got corrupted.
> 	*/
> 	int swap_dup_entry_direct(swp_entry_t entry)
> 	{
> 		si = swap_entry_to_info(entry);
> 		if (WARN_ON_ONCE(!si)) {
> 			pr_err("%s%08lx\n", Bad_file, entry.val);
> 			return -EINVAL;
> 
> But, I do agree -EINVAL is too soft given the situation we are in.
> 
> I will return -EIO in the next version, if I don't hear any concern.

Sounds definitely better.

-- 
Cheers,

David

Re: [PATCH 2/3] mm, swap: distinguish a malformed swap entry from a dying device

[Pedro Falcato]

On Wed, Aug 12, 2026 at 03:48:56AM -0700, Breno Leitao wrote:
> Hello David,
> 
> On Tue, Aug 11, 2026 at 05:36:31PM +0200, David Hildenbrand (Arm) wrote:
> > On 8/10/26 18:26, Breno Leitao wrote:
> > > +	return ERR_PTR(-EINVAL);
> > >  }
> >
> > Is -EINVAL really the logical right return value? Running into bad swap entries
> > sounds more serious to me than "-EINVAL" :)
> 
> Good point, maybe we need a strong drug here, what about -EIO?
> 
> I picked -EINVAL because it is what the swap code already returns for
> this exact condition. 
> 
> 
> 	* Returns -EINVAL if the swap entry is invalid, which might
> 	* occur if a page table entry has got corrupted.
> 	*/
> 	int swap_dup_entry_direct(swp_entry_t entry)
> 	{
> 		si = swap_entry_to_info(entry);
> 		if (WARN_ON_ONCE(!si)) {
> 			pr_err("%s%08lx\n", Bad_file, entry.val);
> 			return -EINVAL;
> 
> But, I do agree -EINVAL is too soft given the situation we are in.
> 
> I will return -EIO in the next version, if I don't hear any concern.

Perhaps -EUCLEAN would be a more fitting error. It's generally what
filesystems use, at least (EFSCORRUPTED = EUCLEAN). 

-- 
Pedro

Re: [PATCH 2/3] mm, swap: distinguish a malformed swap entry from a dying device

[David Hildenbrand (Arm)]

On 8/12/26 13:02, Pedro Falcato wrote:
> On Wed, Aug 12, 2026 at 03:48:56AM -0700, Breno Leitao wrote:
>> Hello David,
>>
>> On Tue, Aug 11, 2026 at 05:36:31PM +0200, David Hildenbrand (Arm) wrote:
>>>
>>> Is -EINVAL really the logical right return value? Running into bad swap entries
>>> sounds more serious to me than "-EINVAL" :)
>>
>> Good point, maybe we need a strong drug here, what about -EIO?
>>
>> I picked -EINVAL because it is what the swap code already returns for
>> this exact condition. 
>>
>>
>> 	* Returns -EINVAL if the swap entry is invalid, which might
>> 	* occur if a page table entry has got corrupted.
>> 	*/
>> 	int swap_dup_entry_direct(swp_entry_t entry)
>> 	{
>> 		si = swap_entry_to_info(entry);
>> 		if (WARN_ON_ONCE(!si)) {
>> 			pr_err("%s%08lx\n", Bad_file, entry.val);
>> 			return -EINVAL;
>>
>> But, I do agree -EINVAL is too soft given the situation we are in.
>>
>> I will return -EIO in the next version, if I don't hear any concern.
> 
> Perhaps -EUCLEAN would be a more fitting error. It's generally what
> filesystems use, at least (EFSCORRUPTED = EUCLEAN). 

Not a big fan of EUCLEAN for the use case here. The details don't really matter,
but EINVAL just looked rather odd.

-- 
Cheers,

David

[PATCH 3/3] mm: fail the fault on a malformed swap entry instead of retrying it

[Breno Leitao]

do_swap_page() returns 0 when get_swap_device() fails, which the fault
handler reads as "handled". For an entry that can never become valid
the retry takes the same fault again, so the thread spins until it is
killed.

Return VM_FAULT_SIGBUS for a malformed entry, as the sibling arm
already does for an unrecognised non-swap entry. A NULL return still
means swapoff, which is still worth retrying.

Signed-off-by: Breno Leitao <leitao@debian.org>
---
 mm/memory.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/mm/memory.c b/mm/memory.c
index 4238778b66c42..2842cd976f1d3 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -4957,6 +4957,9 @@ vm_fault_t do_swap_page(struct vm_fault *vmf)
 	/* Prevent swapoff from happening to us. */
 	si = get_swap_device(entry);
 	if (IS_ERR_OR_NULL(si)) {
+		/* A malformed entry never becomes valid, so don't retry it. */
+		if (IS_ERR(si))
+			ret = VM_FAULT_SIGBUS;
 		si = NULL;
 		goto out;
 	}

-- 
2.53.0-Meta

Re: [PATCH 3/3] mm: fail the fault on a malformed swap entry instead of retrying it

[David Hildenbrand (Arm)]

On 8/10/26 18:26, Breno Leitao wrote:
> do_swap_page() returns 0 when get_swap_device() fails, which the fault
> handler reads as "handled". For an entry that can never become valid
> the retry takes the same fault again, so the thread spins until it is
> killed.
> 
> Return VM_FAULT_SIGBUS for a malformed entry, as the sibling arm
> already does for an unrecognised non-swap entry. A NULL return still
> means swapoff, which is still worth retrying.
> 
> Signed-off-by: Breno Leitao <leitao@debian.org>
> ---
>  mm/memory.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/mm/memory.c b/mm/memory.c
> index 4238778b66c42..2842cd976f1d3 100644
> --- a/mm/memory.c
> +++ b/mm/memory.c
> @@ -4957,6 +4957,9 @@ vm_fault_t do_swap_page(struct vm_fault *vmf)
>  	/* Prevent swapoff from happening to us. */
>  	si = get_swap_device(entry);
>  	if (IS_ERR_OR_NULL(si)) {
> +		/* A malformed entry never becomes valid, so don't retry it. */
> +		if (IS_ERR(si))
> +			ret = VM_FAULT_SIGBUS;
>  		si = NULL;
>  		goto out;

Better update the comment above get_swap_device() to include "bad swap entries"
as well. Best do that as part of patch #2.

I didn't look too closely, but conceptually LGTM

-- 
Cheers,

David

Re: [PATCH 3/3] mm: fail the fault on a malformed swap entry instead of retrying it

[Breno Leitao]

On Tue, Aug 11, 2026 at 05:38:50PM +0200, David Hildenbrand (Arm) wrote:
> On 8/10/26 18:26, Breno Leitao wrote:

> > --- a/mm/memory.c
> > +++ b/mm/memory.c
> > @@ -4957,6 +4957,9 @@ vm_fault_t do_swap_page(struct vm_fault *vmf)
> >  	/* Prevent swapoff from happening to us. */
> >  	si = get_swap_device(entry);
> >  	if (IS_ERR_OR_NULL(si)) {
> > +		/* A malformed entry never becomes valid, so don't retry it. */
> > +		if (IS_ERR(si))
> > +			ret = VM_FAULT_SIGBUS;
> >  		si = NULL;
> >  		goto out;
> 
> Better update the comment above get_swap_device() to include "bad swap entries"
> as well. Best do that as part of patch #2.

Ack, I will update and respin.

> I didn't look too closely, but conceptually LGTM

Thanks for the review so far!
--breno

Re: [PATCH 3/3] mm: fail the fault on a malformed swap entry instead of retrying it

[Pedro Falcato]

On Mon, Aug 10, 2026 at 09:26:51AM -0700, Breno Leitao wrote:
> do_swap_page() returns 0 when get_swap_device() fails, which the fault
> handler reads as "handled". For an entry that can never become valid
> the retry takes the same fault again, so the thread spins until it is
> killed.
> 
> Return VM_FAULT_SIGBUS for a malformed entry, as the sibling arm
> already does for an unrecognised non-swap entry. A NULL return still
> means swapoff, which is still worth retrying.

What kind of SIGBUS do you get from this? as in the si_code. Out of all
the options

#define BUS_ADRALN	1	/* invalid address alignment */
#define BUS_ADRERR	2	/* non-existent physical address */
#define BUS_OBJERR	3	/* object specific hardware error */
/* hardware memory error consumed on a machine check: action required */
#define BUS_MCEERR_AR	4
/* hardware memory error detected in process but not consumed: action optional*/
#define BUS_MCEERR_AO	5

I would say this would fit none of them. The default (AFAICT) would be
BUS_ADRERR, and I think that one is quite overloaded with meaning (namely,
with regards to memory-mapped IO past EOF, or EIO on file IO). I wouldn't
love to also use it for this, IMO.

> 
> Signed-off-by: Breno Leitao <leitao@debian.org>
> ---
>  mm/memory.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/mm/memory.c b/mm/memory.c
> index 4238778b66c42..2842cd976f1d3 100644
> --- a/mm/memory.c
> +++ b/mm/memory.c
> @@ -4957,6 +4957,9 @@ vm_fault_t do_swap_page(struct vm_fault *vmf)
>  	/* Prevent swapoff from happening to us. */
>  	si = get_swap_device(entry);
>  	if (IS_ERR_OR_NULL(si)) {
> +		/* A malformed entry never becomes valid, so don't retry it. */
> +		if (IS_ERR(si))
> +			ret = VM_FAULT_SIGBUS;
>  		si = NULL;
>  		goto out;
>  	}
> 
> -- 
> 2.53.0-Meta
> 

-- 
Pedro

Re: [PATCH 3/3] mm: fail the fault on a malformed swap entry instead of retrying it

[David Hildenbrand (Arm)]

On 8/12/26 12:59, Pedro Falcato wrote:
> On Mon, Aug 10, 2026 at 09:26:51AM -0700, Breno Leitao wrote:
>> do_swap_page() returns 0 when get_swap_device() fails, which the fault
>> handler reads as "handled". For an entry that can never become valid
>> the retry takes the same fault again, so the thread spins until it is
>> killed.
>>
>> Return VM_FAULT_SIGBUS for a malformed entry, as the sibling arm
>> already does for an unrecognised non-swap entry. A NULL return still
>> means swapoff, which is still worth retrying.
> 
> What kind of SIGBUS do you get from this? as in the si_code. Out of all
> the options
> 
> #define BUS_ADRALN	1	/* invalid address alignment */
> #define BUS_ADRERR	2	/* non-existent physical address */
> #define BUS_OBJERR	3	/* object specific hardware error */
> /* hardware memory error consumed on a machine check: action required */
> #define BUS_MCEERR_AR	4
> /* hardware memory error detected in process but not consumed: action optional*/
> #define BUS_MCEERR_AO	5
> 
> I would say this would fit none of them. The default (AFAICT) would be
> BUS_ADRERR, and I think that one is quite overloaded with meaning (namely,
> with regards to memory-mapped IO past EOF, or EIO on file IO). I wouldn't
> love to also use it for this, IMO.

Note that what is discussed here that should usually happen unless kernel bug.
So I don't think we have to worry about the details here, really.

It's similar to the VM_FAULT_SIGBUS handling earlier in the function after the
print_bad_pte().

-- 
Cheers,

David

Re: [PATCH 0/3] mm, swap: don't spin or flood the console on a bad swap entry

[Andrew Morton]

On Mon, 10 Aug 2026 09:26:48 -0700 Breno Leitao <leitao@debian.org> wrote:

> I've seen some machines at Meta flete that show the following type of
> problem:
> 
> 1) It gets some weird warning:
> 
>   BUG: Bad page map in process khugepaged  pte:f000eef300000017 pmd:00000067
>   addr:00007f57c0a01000 vm_flags:20200073 anon_vma:ffff88829af7c340 mapping:0000000000000000 index:7f57c0a01
> 
> The corruption is most likely the collapse/PT_RECLAIM race fixed by
> commit 366a4532d96f ("mm: fix the race between collapse and PT_RECLAIM
> under per-vma lock"). But this series is not about tha.
> 
> 2) Then it floods all the monitoring of the fleet, sending the same
>    message in the loop, crashing the our fleet kernel monitoring
>    subsystem (which is the part that I am interested in protecting)
> 
>   get_swap_device: Bad swap offset entry 3ffffffc043c5
> 
> For instance, in a host today it logged 6M in a few hours, and it is still
> going forever. Two things go wrong.
> 
> 1) get_swap_device() prints unconditionally, unlike print_bad_pte() next
>    door which suppresses itself with is_bad_page_map_ratelimited().
> 
> 1) do_swap_page() returns 0 when get_swap_device() fails, so the
>    fault is retried, reads the same entry and faults again.
>    Nothing in the round trip changes the PTE.
> 
> Trying to fix it in a naive way:

Thanks.  Sashiko said a bunch of things, all pre-existing.
	https://sashiko.dev/#/patchset/20260810-swap-v1-0-375ef0767206@debian.org

You might wat to address the first one as it's on-topic for this
patchset.  Ther are some swap things.  The remainder are for the poor
uffd maintainers to scratch at, if inclined.

Re: [PATCH 0/3] mm, swap: don't spin or flood the console on a bad swap entry

[Breno Leitao]

On Mon, Aug 10, 2026 at 10:20:34AM -0700, Andrew Morton wrote:
> On Mon, 10 Aug 2026 09:26:48 -0700 Breno Leitao <leitao@debian.org> wrote:
> > Trying to fix it in a naive way:
> 
> Thanks.  Sashiko said a bunch of things, all pre-existing.
> 	https://sashiko.dev/#/patchset/20260810-swap-v1-0-375ef0767206@debian.org
> 
> You might wat to address the first one as it's on-topic for this
> patchset.  Ther are some swap things.  The remainder are for the poor
> uffd maintainers to scratch at, if inclined.

Ack.

Rate limiting swap_dup_entry_direct() is right on its own: it prints the
same Bad_file message as get_swap_device() does, we have another case we
want to rate limit as well. 

I will update and respin.
--breno