From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from lgeamrelo03.lge.com (lgeamrelo03.lge.com [156.147.51.102]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 38982486B9A for ; Thu, 6 Aug 2026 19:21:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=156.147.51.102 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786044102; cv=none; b=TsFHqF/uMab7uvUqzFbgFBvOySIuExEaH+x4QhRnHUe9qymYXKtX3ypnjyLVr1p0WPGv3JMIIrCDjwy2keaTIaLhoPsRUg0mBM0rVoFWfObBNBDNTWChmf8iQ2ADvfhzuj/ixnXpN3GYNKFv3FAWus+2jGx8CmH9vJ69eEu2OJg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786044102; c=relaxed/simple; bh=tvedFFDG0v0nK4UHcbQHu/cv4PfffCZwjc4utGb+RLU=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=ZQSbpMhFk77KMipwNQtJdSkIEBRmH8xL/4ZexufrHwx+/zwMDx0nRkXyqd1fd7xDhA7BIYtknTVvXDNLv7VKrZRIoZmUQXs81ng3wFvHMaIuNUFg4L8gf6+WvktJ2ZwZd1P46ps+pAn6ZmmKmCYUqvR/paSUutbzXLtn8Va+shU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=lge.com; spf=pass smtp.mailfrom=lge.com; arc=none smtp.client-ip=156.147.51.102 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=lge.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=lge.com Received: from unknown (HELO yjaykim-PowerEdge-T330.lge.net) (10.177.112.156) by 156.147.51.102 with ESMTP; 7 Aug 2026 04:06:36 +0900 X-Original-SENDERIP: 10.177.112.156 X-Original-MAILFROM: youngjun.park@lge.com From: Youngjun Park To: Andrew Morton Cc: Chris Li , Kairui Song , Kemeng Shi , Nhat Pham , Baoquan He , Barry Song , Jianyue Wu , Youngjun Park , her0gyugyu@gmail.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: [PATCH 3/4] mm, swap: only allow swapped-out slots into the swap cache Date: Fri, 7 Aug 2026 04:06:35 +0900 Message-Id: <20260806190636.446205-4-youngjun.park@lge.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260806190636.446205-1-youngjun.park@lge.com> References: <20260806190636.446205-1-youngjun.park@lge.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit __swap_cache_add_check() turns away folio entries and slots with no count and lets everything else in. That is safe only when the caller owns the slot. Cluster readahead owns nothing, it walks a raw page_cluster sized window of offsets around the faulting entry. A hibernation slot is not a folio, and the count test does not stop it either, because the type the previous patch added has the count bits set. So readahead allocates a folio and reads the offset off the device into it, for a slot that nothing will ever swap in. A bad slot listed in the swap header gets in the same way, its count bits are set too, and the folio entry that replaces it drops the bad marker. The first patch keeps that folio from doing harm, but the folio and the read still happen. Require a shadow entry instead. A slot dropped from the swap cache always gets one, empty if there is no workingset value. The check runs before the folio allocation in __swap_cache_alloc(), so readahead now skips the offset without allocating or reading. Signed-off-by: Youngjun Park --- mm/swap_state.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/mm/swap_state.c b/mm/swap_state.c index 5be825911e64..9f2cc5918713 100644 --- a/mm/swap_state.c +++ b/mm/swap_state.c @@ -180,9 +180,14 @@ static int __swap_cache_add_check(struct swap_cluster_info *ci, old_tb = __swap_table_get(ci, ci_off); if (swp_tb_is_folio(old_tb)) return -EEXIST; - if (!__swp_tb_get_count(old_tb)) + /* + * Only a swapped-out slot may be brought into the swap cache. + * Cluster readahead walks raw offset ranges, so it can land on + * slots that are free, bad, or owned by hibernation. + */ + if (!swp_tb_is_shadow(old_tb) || !__swp_tb_get_count(old_tb)) return -ENOENT; - if (shadowp && swp_tb_is_shadow(old_tb)) + if (shadowp) *shadowp = swp_tb_to_shadow(old_tb); if (memcg_id) *memcg_id = __swap_cgroup_get(ci, ci_off); -- 2.48.1