Hello Dan

Currently, no caller in kernel will pass NULL mpol with NULL vmf with CONFIG_NUMA. Do do_swap_page always have vmf set, and shmem always have either vmf or mpol set (unless !CONFIG_NUMA).

I used to have a WARN_ON for this but some AI reviewers complained that the WARN_ON is redundant so I removed it. I can add that back later just to be safer, I will add a Reported-by for you. Is that OK?


Dan Carpenter<error27@gmail.com> 在 2026年6月2日 周二 16:02 写道：
Hello Kairui Song,

Commit 128460ca95cf ("mm, swap: add support for stable large
allocation in swap cache directly") from May 17, 2026 (linux-next),
leads to the following Smatch static checker warning:

mm/swap_state.c:434 __swap_cache_alloc()
error: we previously assumed 'mpol' could be null (see line 433)

mm/swap_state.c
    403 static struct folio *__swap_cache_alloc(struct swap_cluster_info *ci,
    404                                         swp_entry_t targ_entry, gfp_t gfp,
    405                                         unsigned int order, struct vm_fault *vmf,
    406                                         struct mempolicy *mpol, pgoff_t ilx)
    407 {
    408         int err;
    409         swp_entry_t entry;
    410         struct folio *folio;
    411         void *shadow = NULL;
    412         unsigned short memcg_id;
    413         unsigned long address, nr_pages = 1UL << order;
    414         struct vm_area_struct *vma = vmf ? vmf->vma : NULL;
    415
    416         VM_WARN_ON_ONCE(nr_pages > SWAPFILE_CLUSTER);
    417         entry.val = round_down(targ_entry.val, nr_pages);
    418
    419         /* Check if the slot and range are available, skip allocation if not */
    420         spin_lock(&ci->lock);
    421         err = __swap_cache_add_check(ci, targ_entry, nr_pages, NULL, NULL);
    422         spin_unlock(&ci->lock);
    423         if (unlikely(err))
    424                 return ERR_PTR(err);
    425
    426         /*
    427          * Limit THP gfp. The limitation is a no-op for typical
    428          * GFP_HIGHUSER_MOVABLE but matters for shmem.
    429          */
    430         if (order)
    431                 gfp = thp_shmem_limit_gfp_mask(vma_thp_gfp_mask(vma), gfp);
    432
    433         if (mpol || !vmf) {
                            ^^^^
imagine mpol is mpol is NULL and so is vmf.

--> 434                 folio = folio_alloc_mpol(gfp, order, mpol, ilx, numa_node_id());
                                                             ^^^^
We can't pass a NULL mpol to folio_alloc_mpol() or it will crash.  Unless
mpol can't be NULL when CONFIG_NUMA is disabled?  I think mpol can be NULL
from do_swap_page() so this looks pretty suspect.

    435         } else {
    436                 address = round_down(vmf->address, PAGE_SIZE << order);
    437                 folio = vma_alloc_folio(gfp, order, vmf->vma, address);
    438         }
    439         if (unlikely(!folio))

This email is a free service from the Smatch-CI project [smatch.sf.net].

regards,
dan carpenter