Re: [PATCH] mm/migrate_device: Clear stale mapping after freeing swapcache

[Yadav, Arvind]

On 24-07-2026 01:09, Zi Yan wrote:
> On 23 Jul 2026, at 6:08, Arvind Yadav wrote:
>
> > __migrate_device_pages() reads the folio mapping before calling
> > folio_free_swap(). When folio_free_swap() succeeds, the folio is removed
> > from the swap cache, but the saved mapping still points to swap_space.
> >
> > Passing the stale mapping to folio_migrate_mapping() makes it take the
> > mapped-folio path after the swapcache reference has been dropped. This can
> > cause an invalid swap_space lock access followed by a folio reference
> > count BUG.
> >
> > Clear the saved mapping so the source is migrated as a mappingless
> > anonymous folio.
> Why not use folio_mapping(folio) in the call to folio_migrate_mapping()?
> Or do mapping = folio_mapping(folio) instead of a hard-coded mapping = NULL?


Agree, Re-reading the mapping is clearer and avoids assuming it is 
always NULL. I’ll update it to refresh mapping after folio_free_swap().
Thanks for the suggestion.

Regards,
Arvind

> > Fixes: df263d9a7dff ("mm/migrate_device: try to handle swapcache pages")
> > Cc: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
> > Cc: David Hildenbrand <david@xxxxxxxxxx>
> > Cc: Matthew Brost <matthew.brost@xxxxxxxxx>
> > Cc: Joshua Hahn <joshua.hahnjy@xxxxxxxxx>
> > Cc: Zi Yan <ziy@xxxxxxxxxx>
> > Cc: Rakie Kim <rakie.kim@xxxxxx>
> > Cc: Byungchul Park <byungchul@xxxxxx>
> > Cc: Gregory Price <gourry@xxxxxxxxxx>
> > Cc: Ying Huang <ying.huang@xxxxxxxxxxxxxxxxx>
> > Cc: Alistair Popple <apopple@xxxxxxxxxx>
> > Signed-off-by: Arvind Yadav <arvind.yadav@xxxxxxxxx>
> > ---
> >   mm/migrate_device.c | 6 ++++++
> >   1 file changed, 6 insertions(+)
> >
> > diff --git a/mm/migrate_device.c b/mm/migrate_device.c
> > index 554754eb26ff..fa7fbacac514 100644
> > --- a/mm/migrate_device.c
> > +++ b/mm/migrate_device.c
> > @@ -1204,6 +1204,12 @@ static void __migrate_device_pages(unsigned long *src_pfns,
> >   					src_pfns[i] &= ~MIGRATE_PFN_MIGRATE;
> >   					goto next;
> >   				}
> > +
> > +				/*
> > +				 * folio_free_swap() removed the folio from the swap
> > +				 * cache. Migrate it as a mappingless anonymous folio.
> > +				 */
> > +				mapping = NULL;
> >   			}
> >   		} else if (folio_is_zone_device(newfolio)) {
> >   			/*
> > --
> > 2.43.0
>
> Best Regards,
> Yan, Zi