Re: [PATCH v8 14/30] mm: zswap: reject high-order swap cache allocations backed by zswap

[Yosry Ahmed]

On Fri, Oct 2, 2026 at 2:56 AM Usama Arif <usama.arif@xxxxxxxxx> wrote:
>
> zswap stores swapped-out pages one at a time, so a range of swap slots can
> be split between zswap entries and the backing device. A high-order
> swap-cache folio over such a range cannot be read back in one go: the disk
> read would return stale or zero data for every slot zswap owns.
>
> Reject that in __swap_cache_alloc(). Do the check after the folio is in the
> swap cache: from that point zswap can neither start storing nor start
> writing back any slot in the range, so the answer is stable. Callers
> already fall back to order-0, which zswap_load() handles per page.
>
> Export zswap_is_present() for the PMD-order swap-in users added later.
>
> Co-developed-by: Alexandre Ghiti <alex@xxxxxxxx>
> Signed-off-by: Alexandre Ghiti <alex@xxxxxxxx>
> Signed-off-by: Usama Arif <usama.arif@xxxxxxxxx>

Overall looks good, but I think it can be split into 3 patches (one of
which doesn't have to be part of this series), see below.



> ---
>  include/linux/zswap.h |  6 ++++++
>  mm/swap_state.c       | 39 +++++++++++++++++++++++++--------------
>  mm/zswap.c            | 12 +++++++++---
>  3 files changed, 40 insertions(+), 17 deletions(-)
>
> diff --git a/include/linux/zswap.h b/include/linux/zswap.h
> index df6cafbe95dc0..94746fb71bb65 100644
> --- a/include/linux/zswap.h
> +++ b/include/linux/zswap.h
> @@ -35,6 +35,7 @@ void zswap_lruvec_state_init(struct lruvec *lruvec);
>  void zswap_folio_swapin(struct folio *folio);
>  bool zswap_is_enabled(void);
>  bool zswap_never_enabled(void);
> +bool zswap_is_present(swp_entry_t entry, unsigned int nr);
>  #else
>
>  struct zswap_lruvec_state {};
> @@ -73,6 +74,11 @@ static inline bool zswap_never_enabled(void)
>         return true;
>  }
>
> +static inline bool zswap_is_present(swp_entry_t entry, unsigned int nr)
> +{
> +       return false;
> +}
> +
>  #endif
>
>  #endif /* _LINUX_ZSWAP_H */
> diff --git a/mm/swap_state.c b/mm/swap_state.c
> index 625c185a1ca4d..251b48b2c60e1 100644
> --- a/mm/swap_state.c
> +++ b/mm/swap_state.c
> @@ -12,6 +12,7 @@
>  #include <linux/kernel_stat.h>
>  #include <linux/mempolicy.h>
>  #include <linux/swap.h>
> +#include <linux/zswap.h>
>  #include <linux/leafops.h>
>  #include <linux/init.h>
>  #include <linux/pagemap.h>
> @@ -466,26 +467,27 @@ static struct folio *__swap_cache_alloc(struct swap_cluster_info *ci,
>         __swap_cache_do_add_folio(ci, folio, entry);
>         spin_unlock(&ci->lock);
>
> +       /*
> +        * Now that the folio is in the swap cache, zswap can no longer start
> +        * storing or writing back any slot in the range, so this is a stable
> +        * answer. Reject a high-order allocation over a range that already
> +        * has per-page zswap entries.
> +        */
> +       if (order && zswap_is_present(entry, nr_pages)) {
> +               err = -EBUSY;
> +               goto delete_folio;
> +       }
> +
>         if (mem_cgroup_swapin_charge_folio(folio, memcg_id,
>                                            vmf ? vmf->vma->vm_mm : NULL, gfp)) {
> -               spin_lock(&ci->lock);
> -               __swap_cache_do_del_folio(ci, folio, entry, shadow);
> -               spin_unlock(&ci->lock);
> -               folio_unlock(folio);
> -               /* nr_pages refs from swap cache, 1 from allocation */
> -               folio_put_refs(folio, nr_pages + 1);
> +               err = -ENOMEM;
>                 count_mthp_stat(order, MTHP_STAT_SWPIN_FALLBACK_CHARGE);
> -               return ERR_PTR(-ENOMEM);
> +               goto delete_folio;
>         }
>
>         if (order > 1 && folio_memcg_alloc_deferred(folio)) {
> -               spin_lock(&ci->lock);
> -               __swap_cache_do_del_folio(ci, folio, entry, shadow);
> -               spin_unlock(&ci->lock);
> -               folio_unlock(folio);
> -               /* nr_pages refs from swap cache, 1 from allocation */
> -               folio_put_refs(folio, nr_pages + 1);
> -               return ERR_PTR(-ENOMEM);
> +               err = -ENOMEM;
> +               goto delete_folio;
>         }
>
>         /* memsw uncharges swap when folio is added to swap cache */
> @@ -499,6 +501,15 @@ static struct folio *__swap_cache_alloc(struct swap_cluster_info *ci,
>         /* Caller will initiate read into locked new_folio */
>         folio_add_lru(folio);
>         return folio;
> +
> +delete_folio:
> +       spin_lock(&ci->lock);
> +       __swap_cache_do_del_folio(ci, folio, entry, shadow);
> +       spin_unlock(&ci->lock);
> +       folio_unlock(folio);
> +       /* nr_pages refs from swap cache, 1 from allocation */
> +       folio_put_refs(folio, nr_pages + 1);
> +       return ERR_PTR(err);

Nit: You can pull the refactoring into a separate patch (as well as
most zswap changes, see below), so that this patch only has the
logical change to bail for higher orders if any entry is in zswap.

>  }
>
>  /**
> diff --git a/mm/zswap.c b/mm/zswap.c
> index 507f2d19fd2a4..f5b5827d30084 100644
> --- a/mm/zswap.c
> +++ b/mm/zswap.c
> @@ -1587,11 +1587,14 @@ bool zswap_store(struct folio *folio)
>   * @entry: base swap entry of the range
>   * @nr: number of contiguous slots to check
>   *
> - * Context: The caller must keep the range pinned, otherwise the answer can
> - * change under it.
> + * Context: Unless the caller keeps the range pinned, the answer is only a
> + * hint: zswap can store or write back a slot right after this returns. A
> + * caller that needs a stable answer must pin the range first, as
> + * __swap_cache_alloc() does by inserting the folio into the swap cache before
> + * asking.

I would rather avoid naming specific functions as it will go stale
quickly, and instead list the ways of "pinning" a range.

Also, generally, the changes to mm/zswap.c seem orthogonal to this
patch and can be a separate patch (which would be clearer if
__swap_cache_alloc() isn't named here).

>   * Return: true if at least one slot in the range is in zswap.
>   */
> -static bool zswap_is_present(swp_entry_t entry, unsigned int nr)
> +bool zswap_is_present(swp_entry_t entry, unsigned int nr)
>  {
>         pgoff_t offset = swp_offset(entry);
>         struct xarray *tree = swap_zswap_tree(entry);
> @@ -1605,6 +1608,9 @@ static bool zswap_is_present(swp_entry_t entry, unsigned int nr)
>          */
>         BUILD_BUG_ON(SWAPFILE_CLUSTER > ZSWAP_ADDRESS_SPACE_PAGES);
>
> +       if (zswap_never_enabled())
> +               return false;
> +
>         return xa_find(tree, &index, offset + nr - 1, XA_PRESENT);
>  }
>
> --
> 2.53.0-Meta
>