From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A46E44A4988 for ; Thu, 3 Sep 2026 12:46:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788439565; cv=none; b=RR5PKCBKwvHjbsH7QZhN/KtVUueBU9F6fqZz3nQzDghe6kKk3FdmYYsJS89/cwzRF/e3TZtg3UhXFmTb9ZO6psW1S42FE7+R8ZTiFJGbjprtCNGVTrABmqie+8s6C/jV2UoGkzmVuATcM/LVq9WB7yWtYDlYX8HVXXreKuIIZPw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788439565; c=relaxed/simple; bh=ecB/00MQGre3lIQzRV9WHZht+OkpSQz/7NLv5pGgMVQ=; h=Subject:To:Cc:From:Date:Message-ID:MIME-Version:Content-Type; b=qTB0qL65g9dpoOcWOe6Mrq+lzqKf4rABxmN0xChh7Jv6lzLmLj/5iNG7DQbDm0N+FKEK9aBM9ITav9uslPNrI2B5tfX+MjQWlRu2VMRu7mbjchSjpwA7eFuT8MfKJ8YARVIpU4t6OwpPprFvCuKsyfFS3uLJzbU47bO+DNKAbik= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Z1/PP/+5; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Z1/PP/+5" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0D05E1F00A3A; Thu, 3 Sep 2026 12:46:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1788439564; bh=iwomDUMv3PP1F3Q4ECdrmH1rzydkvB0ITlz8w3De7Cc=; h=Subject:To:Cc:From:Date; b=Z1/PP/+5EjIEsrqoViWpp8kvr6T/6A5EM5ndRY5/rCfZSCW/JVkYoEVdmL0amY/no Zz6xj+G/7kRyWDCLS6WRqgj+vEApMNnJ0hOeMa+iWttIIBE5WU6NWr7o1C9odSwcUy P4Njx21u2dIYhSEjxl15GjGZUE0LWlvYTTqTOmo4= Subject: FAILED: patch "[PATCH] mm/migrate_device: clear stale mapping after freeing" failed to apply to 6.18-stable tree To: arvind.yadav@intel.com,akpm@linux-foundation.org,apopple@nvidia.com,balbirs@nvidia.com,byungchul@sk.com,david@kernel.org,gourry@gourry.net,joshua.hahnjy@gmail.com,matthew.brost@intel.com,rakie.kim@sk.com,stable@vger.kernel.org,ying.huang@linux.alibaba.com,ziy@nvidia.com Cc: From: Date: Thu, 03 Sep 2026 12:48:42 +0200 Message-ID: <2026090342-staging-boned-79f6@gregkh> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit The patch below does not apply to the 6.18-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.18.y git checkout FETCH_HEAD git cherry-pick -x 34a00895d032a414830d41106a09329ae6c251b6 # git commit -s git send-email --to '' --in-reply-to '2026090342-staging-boned-79f6@gregkh' --subject-prefix 'PATCH 6.18.y' 'HEAD^..' Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 34a00895d032a414830d41106a09329ae6c251b6 Mon Sep 17 00:00:00 2001 From: Arvind Yadav Date: Tue, 28 Jul 2026 11:58:32 +0530 Subject: [PATCH] mm/migrate_device: clear stale mapping after freeing swapcache __migrate_device_pages() reads the folio mapping before calling folio_free_swap(). When folio_free_swap() succeeds, the folio is removed from the swap cache, but the saved mapping still points to swap_space. Passing the stale mapping to folio_migrate_mapping() makes it use the mapped-folio path for a folio that is no longer in swapcache. It can then operate on swap_space.i_pages with invalid reference accounting, eventually triggering a folio reference count BUG. After a successful split, nr still contains the number of pages in the original large folio, although each resulting page is now a separate order-0 folio. Reset nr to 1 so each split folio is processed separately, including its own swapcache removal and mapping lookup. Refresh the saved mapping after folio_free_swap() so the current folio state is used during migration. Link: https://lore.kernel.org/20260728062832.1107127-1-arvind.yadav@intel.com Fixes: df263d9a7dff ("mm/migrate_device: try to handle swapcache pages") Signed-off-by: Arvind Yadav Reviewed-by: Zi Yan Reviewed-by: Balbir Singh Cc: David Hildenbrand Cc: Matthew Brost Cc: Joshua Hahn Cc: Rakie Kim Cc: Byungchul Park Cc: Gregory Price Cc: Ying Huang Cc: Alistair Popple Cc: Signed-off-by: Andrew Morton diff --git a/mm/migrate_device.c b/mm/migrate_device.c index 18d097c38853..9a346162c688 100644 --- a/mm/migrate_device.c +++ b/mm/migrate_device.c @@ -1193,6 +1193,13 @@ static void __migrate_device_pages(unsigned long *src_pfns, MIGRATE_PFN_COMPOUND); goto next; } + + /* + * reset nr so that only first after-split folio + * is processed below + */ + VM_WARN_ON_ONCE(folio_test_large(folio)); + nr = 1; } else if ((src_pfns[i] & MIGRATE_PFN_MIGRATE) && (dst_pfns[i] & MIGRATE_PFN_COMPOUND) && !(src_pfns[i] & MIGRATE_PFN_COMPOUND)) { @@ -1232,6 +1239,12 @@ static void __migrate_device_pages(unsigned long *src_pfns, folio = page_folio(migrate_pfn_to_page(src_pfns[i+j])); newfolio = page_folio(migrate_pfn_to_page(dst_pfns[i+j])); + /* + * folio_free_swap() removed the folio from the swap + * cache. Refresh the saved mapping before migration. + */ + mapping = folio_mapping(folio); + r = folio_migrate_mapping(mapping, newfolio, folio, extra_cnt); if (r) src_pfns[i+j] &= ~MIGRATE_PFN_MIGRATE;