From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794273352; b=nnbAt/UVDih7J1jHOr1R1bpmKmvIrsVBEq9HfO3B37pgmfcMY0e6pHzJzcQo6fFQB6Vp yX8lQLZ/Hsvd+NiTPIhT2xGR3C4Imwhcl6qFy4nxMYuWKg6rkaavmdoQJXC1lowS0UlDW E1e2vN0y5AMePKaTMWeb9JrtnQLBK3sNtarXcAb5WIQYaS/dff5zs9HyHe2qkdtFlSDi2 +ApOz9fykRR3bAVYCRSn+KveGTbxu0JnNwhuNHjXgRlKDsBvWK7458qUWW+WK419UO2qA SonPU3y0o9ZQ+Xq4ZSw8yYeRtn8KOcV0iz8tncElNuKv1xtVjrHp52I9oeDSVxvuypQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794273352; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: MIME-Version:Content-Type:Content-Transfer-Encoding; bh=43KA6ENjJx2c1JEwvgG1G21X5Xc9ozKwLfwU7jbooRA=; b=DH7aaJNlYOoz98zsKr7MjlpPNDOOJ2tGnPq6LdDWqrXl2jIjKYedGAODwKfkO55sYiKB L/IaFd9lbMliIKIn5E5BDdYPFJDT3/OuidOeg1LHn6CWcSgxEZ+GO53kai6lx0X94gtT9 EtISCubbUHQJFSiv1xaepxYzc/queiJUpq2IgLqcG7j4oMepSa3keWl++q+FFbKqiYVZY 6VmcbWp1zFsb1yg1IvC9wENiezNopgCV9buEDz4yz9RBnntlw1JSg/ljebKWKIGWlAI2F SMAGiqJXSkthuUsW1VJH77LpqZ508q7kRMIHklTPz+IWXF0npx2hN7aqKvrLlVGjSzA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=Yl5JEuvz; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 32554606A31C for ; Tue, 10 Nov 2026 01:15:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=Yl5JEuvz Received: by smtp.kernel.org (Postfix) with ESMTPSA id 805101F0089F; Tue, 10 Nov 2026 01:15:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1794273352; bh=43KA6ENjJx2c1JEwvgG1G21X5Xc9ozKwLfwU7jbooRA=; h=From:To:Cc:Subject:Date; b=Yl5JEuvz6sFhYK75Vl4NS1C0hVyFsXxylwy9bsD8P/H7VXqaoMr2i0z2USKzwIZUQ avUyIXxLS0yNY+0vl8n6DWLnBepY5zUubH2WPoZ55V+U4+ZDOr4lANAMUN5Kj5BstL bPzuKoa0YzpGgjaDcqSt+pFkhzc0qgxw8Z94nrNmmztYJD1F7e+R7oAIxWvL1moUNr lFC27AOThFpA91fGKl9K6O4jDCAOzfwKfQZfZ7bZ6rDl0A7lj8ZKuhID0gHDBN4ojL nOppZ2Vjt9S8V6Qtft0pIZ2jQnpPReqN9K8wQDTy0xFTKMfOlVBc3MZcgkwVldWaIh cGoGHdljBb2Jg== From: Sasha Levin To: david@kernel.org, gourry@gourry.net, baolin.wang@linux.alibaba.com Cc: stable@vger.kernel.org Subject: FAILED: patch "[PATCH] mm/shmem: fix accounting of swapin-error markers" failed to apply to 6.1-stable tree Date: Mon, 9 Nov 2026 20:15:50 -0500 Message-ID: <20261109201550-failed-6.1-66ce68a249f4@kernel.org> X-Mailer: git-send-email 2.53.0 X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x 66ce68a249f4ac56cd6968aa6d8ded20fb4b7d09 # git commit -s git send-email --to '' --in-reply-to '20261109201550-failed-6.1-66ce68a249f4@kernel.org' --subject-prefix 'PATCH 6.1.y' 'HEAD^..' Thanks, Sasha ------------------ original commit in Linus's tree ------------------ >From 66ce68a249f4ac56cd6968aa6d8ded20fb4b7d09 Mon Sep 17 00:00:00 2001 From: "David Hildenbrand (Arm)" Date: Thu, 29 Oct 2026 11:43:35 +0100 Subject: [PATCH] mm/shmem: fix accounting of swapin-error markers A failed swap read replaces the swap entry with a swapin-error marker in the page-cache and subtracts its pages from "alloced" and "swapped"; however, it leaves their block charge in place. Removing the marker during truncate then subtracts from "swapped" again. This can underflow the counters or make swapped reach zero while other pages remain swapped out, causing swapoff to loop without finding them. When installing the marker, subtract only from "swapped" and let shmem_recalc_inode() reduce "alloced" and release the block charge. Make shmem_free_swap() report successful removal separately from the number of swap pages freed, so removing a swapin-error marker does not subtract from "swapped" again. It's a bit confusing, but replacing a swapped out page by a swapin-error marker in shmem_set_folio_swapin_error() behaves as follows: Initially: alloced=1, swapped=1, nrpages=0 Calling shmem_recalc_inode(inode, 0, -1) -> swapped = 0 -> freed = 1 - 0 - 0 = 1 -> alloced -= freed -> alloced=0, swapped=0, block charge released Fixes: 6cec2b95dadf ("mm/shmem: fix infinite loop when swap in shmem error at swapoff time") Cc: stable@vger.kernel.org Tested-by: Gregory Price (Meta) Reviewed-by: Baolin Wang Link: https://patch.msgid.link/20261029-fixes_shmem-v4-14-392fc715d8f6@kernel.org Signed-off-by: David Hildenbrand (Arm) --- mm/shmem.c | 31 ++++++++++++++----------------- 1 file changed, 14 insertions(+), 17 deletions(-) diff --git a/mm/shmem.c b/mm/shmem.c index eb2e6e50630c0..897f19ed0fe3d 100644 --- a/mm/shmem.c +++ b/mm/shmem.c @@ -1177,12 +1177,11 @@ static void shmem_delete_from_page_cache(struct folio *folio, void *radswap) } /* - * Remove swap entry from page cache, free the swap and its page cache. Returns - * the number of pages being freed. 0 means entry not found in XArray (0 pages - * being freed). + * Remove a swap entry or swapin-error marker wholly within [index, end]. + * Return whether it was removed, counting freed swap pages in nr_swaps_freed. */ -static long shmem_free_swap(struct address_space *mapping, - pgoff_t index, pgoff_t end, void *radswap) +static bool shmem_free_swap(struct address_space *mapping, + pgoff_t index, pgoff_t end, void *radswap, long *nr_swaps_freed) { XA_STATE(xas, &mapping->i_pages, index); const softleaf_t swp = radix_to_swp_entry(radswap); @@ -1203,8 +1202,10 @@ static long shmem_free_swap(struct address_space *mapping, xas_unlock_irq(&xas); /* A swapin-error marker holds no swap slot, so just drop it. */ - if (nr_pages && softleaf_is_swap(swp)) + if (nr_pages && softleaf_is_swap(swp)) { swap_put_entries_direct(swp, nr_pages); + *nr_swaps_freed += nr_pages; + } return nr_pages; } @@ -1358,8 +1359,8 @@ static void shmem_undo_range(struct inode *inode, loff_t lstart, uoff_t lend, if (xa_is_value(folio)) { if (unfalloc) continue; - nr_swaps_freed += shmem_free_swap(mapping, indices[i], - end - 1, folio); + shmem_free_swap(mapping, indices[i], end - 1, + folio, &nr_swaps_freed); continue; } @@ -1422,13 +1423,11 @@ static void shmem_undo_range(struct inode *inode, loff_t lstart, uoff_t lend, if (xa_is_value(folio)) { int order; - long swaps_freed; if (unfalloc) continue; - swaps_freed = shmem_free_swap(mapping, indices[i], - end - 1, folio); - if (!swaps_freed) { + if (!shmem_free_swap(mapping, indices[i], end - 1, + folio, &nr_swaps_freed)) { pgoff_t base = indices[i]; order = shmem_confirm_swap(mapping, indices[i], @@ -1449,7 +1448,6 @@ static void shmem_undo_range(struct inode *inode, loff_t lstart, uoff_t lend, index = base; break; } - nr_swaps_freed += swaps_freed; continue; } @@ -2409,11 +2407,10 @@ static void shmem_set_folio_swapin_error(struct inode *inode, pgoff_t index, folio_put_swap(folio, NULL); swap_cache_del_folio(folio); /* - * Don't treat swapin error folio as alloced. Otherwise inode->i_blocks - * won't be 0 when inode is released and thus trigger WARN_ON(i_blocks) - * in shmem_evict_inode(). + * Let shmem_recalc_inode() reduce alloced and release the block charge + * for the freed swap pages. */ - shmem_recalc_inode(inode, -nr_pages, -nr_pages); + shmem_recalc_inode(inode, 0, -nr_pages); } static int shmem_split_large_entry(struct inode *inode, pgoff_t index, -- 2.53.0