From nobody Fri Jul 24 21:52:32 2026 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 85397349CEF for ; Thu, 23 Jul 2026 10:09:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.10 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784801353; cv=none; b=ay2SR2CqlQIePX6R73AH+4MWFih/UGFqOIaXfy8Qa6NWIAgfiDnkW8GXJnC54uhFvp+b7+s1DEO28gzqSU9VBY6FMgP/9Y+FaBTntpnpZ91zNNQNWZWltr4KBA2+FdTkdicPqwHBArBi8jE6kjCefnaBGvssRoB0MdKoWuI8jgU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784801353; c=relaxed/simple; bh=Pd+h33cBRehgFOQwH2D+JNwQdZnkSg99+8xh6je/0rQ=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=cJz9goVfAlLS4k5MjmQejVazRWg4LQsdoiZKqH7tnA22k6KjMArY6i8fHB6FaOno7fiYOviqjIDp37JM/HBOtZHn2Mj1e6RsnQDY32BzyiWizsbMaVZkIJ26ZKlgsOzDPCKUsZFdOYFK6XPT4m9vHIvQ1IP6a7lFQJm4KfgH0vI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=FJ85N2TH; arc=none smtp.client-ip=192.198.163.10 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="FJ85N2TH" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1784801351; x=1816337351; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=Pd+h33cBRehgFOQwH2D+JNwQdZnkSg99+8xh6je/0rQ=; b=FJ85N2TH2w3i+7WyY8Su7L7tghXPYJ50McPElUD8sX8auxISsRC3e4bE Quuw5YDi4t8rYSu9pRksz4cG9ncOjCqGB/hdQOXfmPb63kMGajvPcmTtE 4AWbNPx11sslo9QBLmspnNXMxcVOfXZByRMMase2PD3ryuihl7u21EAPf SkppUhZ11u5siKxRGhSlyVKFFh3VLnnvmbDqIqSmQBbyCiUP4zufxtNh8 eMPGNSYPdnJ4i/wTFL7hPSOJu2z2Vjyvgj4gRabwmxDbVTUcdvA+HnoP3 KS00T4abAWMNq0rnbSUSfIC+hc4wvy4ZzEwOgtFAXz5T3ikVKugSL0ZE7 g==; X-CSE-ConnectionGUID: fOeQSDreQU62VOiSNrxegw== X-CSE-MsgGUID: RtmlY6klSB66suROqhELJQ== X-IronPort-AV: E=McAfee;i="6800,10657,11854"; a="96826891" X-IronPort-AV: E=Sophos;i="6.25,180,1779174000"; d="scan'208";a="96826891" Received: from fmviesa006.fm.intel.com ([10.60.135.146]) by fmvoesa104.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 23 Jul 2026 03:09:11 -0700 X-CSE-ConnectionGUID: nMq8FJj4SZmLDhwzODYFKA== X-CSE-MsgGUID: e/1xGqGiSbGpXSOyn4peDQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.25,180,1779174000"; d="scan'208";a="254018301" Received: from varungup-desk.iind.intel.com ([10.190.238.71]) by fmviesa006-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 23 Jul 2026 03:09:07 -0700 From: Arvind Yadav To: linux-mm@kvack.org, linux-kernel@vger.kernel.org Cc: akpm@linux-foundation.org, david@kernel.org, matthew.brost@intel.com, joshua.hahnjy@gmail.com, ziy@nvidia.com, rakie.kim@sk.com, byungchul@sk.com, gourry@gourry.net, ying.huang@linux.alibaba.com, apopple@nvidia.com Subject: [PATCH] mm/migrate_device: Clear stale mapping after freeing swapcache Date: Thu, 23 Jul 2026 15:38:46 +0530 Message-ID: <20260723100846.1880865-1-arvind.yadav@intel.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" __migrate_device_pages() reads the folio mapping before calling folio_free_swap(). When folio_free_swap() succeeds, the folio is removed from the swap cache, but the saved mapping still points to swap_space. Passing the stale mapping to folio_migrate_mapping() makes it take the mapped-folio path after the swapcache reference has been dropped. This can cause an invalid swap_space lock access followed by a folio reference count BUG. Clear the saved mapping so the source is migrated as a mappingless anonymous folio. Fixes: df263d9a7dff ("mm/migrate_device: try to handle swapcache pages") Cc: Andrew Morton Cc: David Hildenbrand Cc: Matthew Brost Cc: Joshua Hahn Cc: Zi Yan Cc: Rakie Kim Cc: Byungchul Park Cc: Gregory Price Cc: Ying Huang Cc: Alistair Popple Signed-off-by: Arvind Yadav --- mm/migrate_device.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/mm/migrate_device.c b/mm/migrate_device.c index 554754eb26ff..fa7fbacac514 100644 --- a/mm/migrate_device.c +++ b/mm/migrate_device.c @@ -1204,6 +1204,12 @@ static void __migrate_device_pages(unsigned long *sr= c_pfns, src_pfns[i] &=3D ~MIGRATE_PFN_MIGRATE; goto next; } + + /* + * folio_free_swap() removed the folio from the swap + * cache. Migrate it as a mappingless anonymous folio. + */ + mapping =3D NULL; } } else if (folio_is_zone_device(newfolio)) { /* --=20 2.43.0