From nobody Fri Jul 24 21:52:59 2026 Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.9]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2258C31AF24 for ; Fri, 24 Jul 2026 08:27:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=198.175.65.9 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784881648; cv=none; b=TQVC3h1w3W2UpQbB8ioCIo3Vd8rSCkE8BJyv2JnzyrCh3JfbqKI8ywJ4xDyvF0Oq3tokiX8G6OhARpmqGb9JCS9yvHeNdn/sBQ4Bb5VckVk1FnREaWK0VBySpLAj3XLZCuSCf5oCCU3UGKgDvGJlODAD7NkhFqyd93+rxnX+amQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784881648; c=relaxed/simple; bh=m0kTrC2uUZ8YmP9OPjcJHDDgn6fwYkzc3W9o6qAN0fA=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=mrm6WwevKZwW4P50yZKLWJFGxEAkkoYDzgDdRsyZ0oPCpD2pOPLj3RpulTXJ28boEXqwDkMxa2f1fZxtn3ghMHdVhcbPwrXwKpafssfWybXSaADdZoZ/FaFg+sXla7cF6RSvWq7xRIB5WQGX4xgqIJq5kuJiTQTCxZdDvIdzKyY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=MmJhH12z; arc=none smtp.client-ip=198.175.65.9 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="MmJhH12z" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1784881643; x=1816417643; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=m0kTrC2uUZ8YmP9OPjcJHDDgn6fwYkzc3W9o6qAN0fA=; b=MmJhH12zU+CJaW8Svvzmo3+S/QzFhy+A8RNksVDIlN+7kkI7864lxVWB gFEEUNesdXORhBAYje4QzIbkitCnkA96mNKesar3OJgl7SoACP+p8bxgq Im+botPlpWWzLRa4sEZ6KrJIju7Zs8ouLawDQy5oLPHVKYVXcsPrxvh6Z SAW2+ZnYCcH978uNb6S2rnlOil4FUNlI/x0Q9hng7oVcxWD85ejOPIqOq O1gHX5NvRjHhfu0HNOR0JmMUApuLgue62Lc8Hk9ad247HB3pFEHRjaVUV /s/o61iswANpi68z6X5CUYloJUkDTpyPETUkrzN+uZkEYfI/MvPuPkBmt Q==; X-CSE-ConnectionGUID: wVrc48o/Q5WUiegoCTI1gw== X-CSE-MsgGUID: Wm/ncqXBQqaBGa9iwqEsHw== X-IronPort-AV: E=McAfee;i="6800,10657,11854"; a="108334269" X-IronPort-AV: E=Sophos;i="6.25,182,1779174000"; d="scan'208";a="108334269" Received: from fmviesa010.fm.intel.com ([10.60.135.150]) by orvoesa101.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 Jul 2026 01:27:19 -0700 X-CSE-ConnectionGUID: CmLsW23cSkGK5yzJmu7CDA== X-CSE-MsgGUID: tgt31lqRSLSNjfZz0rfEHw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.25,182,1779174000"; d="scan'208";a="254714608" Received: from varungup-desk.iind.intel.com ([10.190.238.71]) by fmviesa010-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 Jul 2026 01:27:15 -0700 From: Arvind Yadav To: linux-mm@kvack.org, linux-kernel@vger.kernel.org Cc: akpm@linux-foundation.org, david@kernel.org, matthew.brost@intel.com, joshua.hahnjy@gmail.com, ziy@nvidia.com, rakie.kim@sk.com, byungchul@sk.com, gourry@gourry.net, ying.huang@linux.alibaba.com, apopple@nvidia.com Subject: [PATCH v2] mm/migrate_device: Clear stale mapping after freeing swapcache Date: Fri, 24 Jul 2026 13:57:02 +0530 Message-ID: <20260724082702.2531024-1-arvind.yadav@intel.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" __migrate_device_pages() reads the folio mapping before calling folio_free_swap(). When folio_free_swap() succeeds, the folio is removed from the swap cache, but the saved mapping still points to swap_space. Passing the stale mapping to folio_migrate_mapping() makes it take the mapped-folio path after the swapcache reference has been dropped. This can cause an invalid swap_space lock access followed by a folio reference count BUG. Refresh the saved mapping after folio_free_swap() so the current folio state is used during migration. v2: - Refresh the mapping using folio_mapping(), as suggested by Zi Yan. Fixes: df263d9a7dff ("mm/migrate_device: try to handle swapcache pages") Cc: Andrew Morton Cc: David Hildenbrand Cc: Matthew Brost Cc: Joshua Hahn Cc: Zi Yan Cc: Rakie Kim Cc: Byungchul Park Cc: Gregory Price Cc: Ying Huang Cc: Alistair Popple Signed-off-by: Arvind Yadav Reviewed-by: Zi Yan --- mm/migrate_device.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/mm/migrate_device.c b/mm/migrate_device.c index 554754eb26ff..ae895758b72c 100644 --- a/mm/migrate_device.c +++ b/mm/migrate_device.c @@ -1204,6 +1204,12 @@ static void __migrate_device_pages(unsigned long *sr= c_pfns, src_pfns[i] &=3D ~MIGRATE_PFN_MIGRATE; goto next; } + + /* + * folio_free_swap() removed the folio from the swap + * cache. Refresh the saved mapping before migration. + */ + mapping =3D folio_mapping(folio); } } else if (folio_is_zone_device(newfolio)) { /* --=20 2.43.0