Re: [PATCH v2 13/14] mm/shmem: fix accounting of swapin-error markers

[Baolin Wang <baolin.wang@linux.alibaba.com>]

On 10/27/26 9:03 PM, David Hildenbrand (Arm) wrote:
> A failed swap read replaces the swap entry with a swapin-error marker in
> the page-cache and subtracts its pages from "alloced" and "swapped";
> however, it leaves their block charge in place.
> 
> Removing the marker during truncate then subtracts from "swapped" again.
> This can underflow the counters or make swapped reach zero while other
> pages remain swapped out, causing swapoff to loop without finding them.
> 
> When installing the marker, subtract only from "swapped" and let
> shmem_recalc_inode() reduce "alloced" and release the block charge.
> 
> Make shmem_free_swap() report successful removal separately from the
> number of swap pages freed, so removing a swapin-error marker does not
> subtract from "swapped" again.
> 
> It's a bit confusing, but replacing a swapped out page by a swapin-error
> marker in shmem_set_folio_swapin_error() behaves as follows:
> 
> Initially:
> 	alloced=1, swapped=1, nrpages=0
> Calling shmem_recalc_inode(inode, 0, -1)
> 	-> swapped = 0
> 	-> freed =  1 - 0 - 0 = 1
> 	-> alloced -= freed
> 	-> alloced=0, swapped=0, block charge released
> 
> Fixes: 6cec2b95dadf ("mm/shmem: fix infinite loop when swap in shmem error at swapoff time")
> Cc: stable@vger.kernel.org
> Tested-by: Gregory Price (Meta) <gourry@gourry.net>
> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
> ---

Good catch. LGTM.
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>