Re: [PATCH v3 02/18] mm/huge_memory: fix rejection of swap cache folios with a mapping

[Kairui Song]

On Thu, Aug 27, 2026 at 4:46 PM Barry Song <baohua@xxxxxxxxxx> wrote:
>
> On Fri, Aug 21, 2026 at 2:55 AM Kairui Song via B4 Relay
> <devnull+kasong.tencent.com@xxxxxxxxxx> wrote:
> >
> > From: Kairui Song <kasong@xxxxxxxxxxx>
> >
> > A folio in the swap cache cannot be split if it has a mapping (shmem).
> > The split code does a defensive check for this in
> > __folio_freeze_and_split_unmapped, after the folio ref has been frozen
> > and the NR_SHMEM_THPS/NR_FILE_THPS counters have been decremented. It
> > rejects the split and returns -EINVAL without unfreezing the folio or
> > restoring the counters. That error path is buggy: if it is ever taken,
> > it leaves the folio frozen and stuck, skews the counters, and fires
> > the VM_WARN_ON_ONCE_FOLIO for a state that is actually legitimate.
> >
> > Check for this case up front in folio_check_splittable and return
> > -EBUSY before any state is modified, so the split routine always backs
> > out cleanly.
> >
> > Also fix a bracket style issue that checkpatch.pl keeps complaining
> > about.
> >
> > Fixes: 00527733d0dc ("mm/huge_memory: add two new (not yet used) functions for folio_split()")
> > Fixes: 714b056c8321 ("mm/huge_memory: convert VM_BUG* to VM_WARN* in __folio_split")
> > Reviewed-by: Zi Yan <ziy@xxxxxxxxxx>
> > Signed-off-by: Kairui Song <kasong@xxxxxxxxxxx>
>
> LGTM,
> Reviewed-by: Barry Song <baohua@xxxxxxxxxx>

Thanks for the review!

> [...]
> >
> > -               if (folio_test_swapcache(folio)) {
> > -                       if (mapping) {
> > -                               VM_WARN_ON_ONCE_FOLIO(mapping, folio);
> > -                               return -EINVAL;
>
> BTW, I’m really curious whether you’ve ever encountered this warning?
>

Nope, found by reading the code. It's possible in theory, the race
window is super short so maybe no one observed it, or observed it but
hard to debug it (a random frozen folio). Anyway we should just fix
it.