Re: [PATCH 1/4] mm, swap: don't free a hibernation slot that is in the swap cache

On Sat, Aug 08, 2026 at 09:26:34PM +0800, Kairui Song wrote:
> On Sat, Aug 08, 2026 at 08:09:44PM +0800, Kairui Song wrote:
> > On Fri, Aug 07, 2026 at 04:06:33AM +0800, Youngjun Park wrote:
> > > A slot with a folio in the swap cache is freed when the folio leaves the
> > > cache, not when its count drops.  swap_put_entries_cluster() follows that
> > > rule.  swap_free_hibernation_slot() does not, it calls
> > > __swap_cluster_free_entries() whether or not a folio sits on the slot.
> > > 
> > > Cluster readahead can put one there.  It walks a raw page_cluster sized
> > > window of offsets around the faulting entry, and a hibernation slot passes
> > > __swap_cache_add_check() because it is not a folio and its count is not
> > > zero.  Freeing the slot then clears the entry under that folio.
> > > 
> > > The folio is now unreachable from the swap table, and the offset goes back
> > > to the allocator.  The folio is still on the LRU though, so reclaim can
> > > pick it up later.  It then takes the old offset out of folio->swap and
> > > overwrites the table entry there, which by then may belong to someone else.
> > > 
> > > Check for a cached folio before freeing.  The slot is then left in the
> > > ordinary state where only the swap cache holds it, and it is freed when the
> > > folio leaves the cache, either through the reclaim below or through normal
> > > reclaim later.
> > > 
> > > Fixes: 0d6af9bcf383 ("mm, swap: use the swap table to track the swap count")
> > > Signed-off-by: Youngjun Park <[email protected]>
> > > ---
> > >  mm/swapfile.c | 9 ++++++++-
> > >  1 file changed, 8 insertions(+), 1 deletion(-)
> > 
> > Hi Youngjun,
> > 
> > Thanks a lot for looking into the hibernation issue, I've been thinking
> > about using a exclusive type for it, glad to see actual code for it :)
> > 
> > And this patch looks good to me, nice catch!
> > 
> > Acked-by: Kairui Song <[email protected]>
> 
> Oh and I think we need to Cc stable?

Right, I will Cc stable next iteration soon.
Thanks for catching.

Youngjun