mm/memory.c | 9 ++++++--- mm/mincore.c | 2 +- mm/shmem.c | 2 +- mm/swap_state.c | 4 ++-- mm/swapfile.c | 14 +++++++++----- mm/userfaultfd.c | 4 ++-- mm/zswap.c | 2 +- 7 files changed, 22 insertions(+), 15 deletions(-)
I've seen some machines at Meta fleet that show the following type of
problem:
1) It gets some weird warning:
BUG: Bad page map in process khugepaged pte:f000eef300000017 pmd:00000067
addr:00007f57c0a01000 vm_flags:20200073 anon_vma:ffff88829af7c340 mapping:0000000000000000 index:7f57c0a01
The corruption is most likely the collapse/PT_RECLAIM race fixed by
commit 366a4532d96f ("mm: fix the race between collapse and PT_RECLAIM
under per-vma lock"). But this series is not about this one.
2) Then the fault never makes progress. do_swap_page() returns 0 when
get_swap_device() fails, so the fault is retried, reads the same
entry and faults again. Nothing in the round trip changes the PTE,
and the same line comes out on every pass:
get_swap_device: Bad swap offset entry 3ffffffc043c5
Patch 1 makes get_swap_device() return ERR_PTR(-EIO) for a malformed
entry, keeping NULL for a device swapoff is taking away, and converts
the callers. No functional change expected.
Patch 2 uses that to return VM_FAULT_SIGBUS instead of retrying.
The rate limiting patch that used to open this series was split out and
posted on its own as a backportable hotfix [1], per Andrew's request. It
should land first: patch 1 here touches the lines next to it in
get_swap_device(). This patch will probably conflict with [1], but the
merge should be trivial, given the only change in [1] is the
addition of the __ratelimited() suffix.
pr_err("%s: %s%08lx\n", __func__, Bad_file, entry.val);
pr_err_ratelimited("%s: %s%08lx\n", __func__, Bad_file, entry.val);
I am happy to respin, in case you prefer
[1] https://patch.msgid.link/20260818-swap_part_one-v1-1-a4fc58119fc0@debian.org
---
Changes in v3:
- Split the rate limiting patch out and posted it separately as a
hotfix, with a Fixes: tag and cc:stable (Andrew)
- Drop the si = NULL dance in do_swap_page() and move_pages_ptes(), and
let the paths that drop the reference skip an error pointer instead
(Barry)
- Link to v2: https://patch.msgid.link/20260813-swap-v2-0-4a625ccabdae@debian.org
Changes in v2:
- Rate limit swap_dup_entry_direct()'s print too (Andrew)
- Drop "in get_swap_device()" from patch 1's subject, it now covers all
three prints
- Return ERR_PTR(-EIO) rather than ERR_PTR(-EINVAL) for a malformed
entry; -EINVAL is too soft for a corrupt page table (David)
- Document the malformed entry case in get_swap_device()'s kerneldoc,
in patch 2 instead of patch 3 (David)
- Reword patch 2's changelog, "an entry that can never name a slot on
any device" was unclear (David)
- Link to v1: https://patch.msgid.link/20260810-swap-v1-0-375ef0767206@debian.org
To: Andrew Morton <akpm@linux-foundation.org>
To: David Hildenbrand <david@kernel.org>
To: Lorenzo Stoakes <ljs@kernel.org>
To: "Liam R. Howlett" <liam@infradead.org>
To: Vlastimil Babka <vbabka@kernel.org>
To: Mike Rapoport <rppt@kernel.org>
To: Suren Baghdasaryan <surenb@google.com>
To: Michal Hocko <mhocko@suse.com>
To: Jann Horn <jannh@google.com>
To: Pedro Falcato <pfalcato@suse.de>
To: Hugh Dickins <hughd@google.com>
To: Baolin Wang <baolin.wang@linux.alibaba.com>
To: Chris Li <chrisl@kernel.org>
To: Kairui Song <kasong@tencent.com>
To: Kemeng Shi <shikemeng@huaweicloud.com>
To: Nhat Pham <nphamcs@gmail.com>
To: Baoquan He <baoquan.he@linux.dev>
To: Barry Song <baohua@kernel.org>
To: Youngjun Park <youngjun.park@lge.com>
To: Peter Xu <peterx@redhat.com>
To: Johannes Weiner <hannes@cmpxchg.org>
To: Yosry Ahmed <yosry@kernel.org>
To: Chengming Zhou <chengming.zhou@linux.dev>
Cc: linux-mm@kvack.org
Cc: linux-kernel@vger.kernel.org
---
Breno Leitao (2):
mm, swap: distinguish a malformed swap entry from a dying device
mm: fail the fault on a malformed swap entry instead of retrying it
mm/memory.c | 9 ++++++---
mm/mincore.c | 2 +-
mm/shmem.c | 2 +-
mm/swap_state.c | 4 ++--
mm/swapfile.c | 14 +++++++++-----
mm/userfaultfd.c | 4 ++--
mm/zswap.c | 2 +-
7 files changed, 22 insertions(+), 15 deletions(-)
---
base-commit: 6b8c8af514d739d0335f5579b585e02babe8a727
change-id: 20260810-swap-25420f9c8ba9
Best regards,
--
Breno Leitao <leitao@debian.org>
On Tue, 18 Aug 2026 03:06:22 -0700 Breno Leitao <leitao@debian.org> wrote:
> I've seen some machines at Meta fleet that show the following type of
> problem:
>
> 1) It gets some weird warning:
>
> BUG: Bad page map in process khugepaged pte:f000eef300000017 pmd:00000067
> addr:00007f57c0a01000 vm_flags:20200073 anon_vma:ffff88829af7c340 mapping:0000000000000000 index:7f57c0a01
>
> The corruption is most likely the collapse/PT_RECLAIM race fixed by
> commit 366a4532d96f ("mm: fix the race between collapse and PT_RECLAIM
> under per-vma lock"). But this series is not about this one.
>
> 2) Then the fault never makes progress. do_swap_page() returns 0 when
> get_swap_device() fails, so the fault is retried, reads the same
> entry and faults again. Nothing in the round trip changes the PTE,
> and the same line comes out on every pass:
>
> get_swap_device: Bad swap offset entry 3ffffffc043c5
>
> Patch 1 makes get_swap_device() return ERR_PTR(-EIO) for a malformed
> entry, keeping NULL for a device swapoff is taking away, and converts
> the callers. No functional change expected.
>
> Patch 2 uses that to return VM_FAULT_SIGBUS instead of retrying.
>
> The rate limiting patch that used to open this series was split out and
> posted on its own as a backportable hotfix [1], per Andrew's request. It
> should land first: patch 1 here touches the lines next to it in
> get_swap_device(). This patch will probably conflict with [1], but the
> merge should be trivial, given the only change in [1] is the
> addition of the __ratelimited() suffix.
>
> pr_err("%s: %s%08lx\n", __func__, Bad_file, entry.val);
> pr_err_ratelimited("%s: %s%08lx\n", __func__, Bad_file, entry.val);
>
Thanks. The patches have bitrotted a little - get_swap_device() was an
easy fixup but please double-check that I didn't miss anything.
Or perhaps just refresh-retest-resend if there's any doubt.
> The rate limiting patch that used to open this series was split out and
> posted on its own as a backportable hotfix [1], per Andrew's request. It
> should land first: patch 1 here touches the lines next to it in
> get_swap_device(). This patch will probably conflict with [1], but the
> merge should be trivial, given the only change in [1] is the
> addition of the __ratelimited() suffix.
>
> pr_err("%s: %s%08lx\n", __func__, Bad_file, entry.val);
> pr_err_ratelimited("%s: %s%08lx\n", __func__, Bad_file, entry.val);
oh, you already said that.
As usual when inspecting our error-path code, Sashiko said "you all suck":
https://sashiko.dev/#/patchset/20260818-swap-v3-0-d3fa52598a59@debian.org
These things do seem on-topic for the changes you're proposing here, so
please take a look?
© 2016 - 2026 Red Hat, Inc.