Re: [PATCH v2] mm/migrate_device: Clear stale mapping after freeing swapcache

[Balbir Singh]

On 7/24/26 6:27 PM, Arvind Yadav wrote:
> __migrate_device_pages() reads the folio mapping before calling
> folio_free_swap(). When folio_free_swap() succeeds, the folio is removed
> from the swap cache, but the saved mapping still points to swap_space.
> 
> Passing the stale mapping to folio_migrate_mapping() makes it take the
> mapped-folio path after the swapcache reference has been dropped. This can
> cause an invalid swap_space lock access followed by a folio reference
> count BUG.
> 
> Refresh the saved mapping after folio_free_swap() so the current folio
> state is used during migration.
> 
> v2:
> - Refresh the mapping using folio_mapping(), as suggested by Zi Yan.
> 
> Fixes: df263d9a7dff ("mm/migrate_device: try to handle swapcache pages")
> Cc: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
> Cc: David Hildenbrand <david@xxxxxxxxxx>
> Cc: Matthew Brost <matthew.brost@xxxxxxxxx>
> Cc: Joshua Hahn <joshua.hahnjy@xxxxxxxxx>
> Cc: Zi Yan <ziy@xxxxxxxxxx>
> Cc: Rakie Kim <rakie.kim@xxxxxx>
> Cc: Byungchul Park <byungchul@xxxxxx>
> Cc: Gregory Price <gourry@xxxxxxxxxx>
> Cc: Ying Huang <ying.huang@xxxxxxxxxxxxxxxxx>
> Cc: Alistair Popple <apopple@xxxxxxxxxx>
> Signed-off-by: Arvind Yadav <arvind.yadav@xxxxxxxxx>
> ---
>  mm/migrate_device.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/mm/migrate_device.c b/mm/migrate_device.c
> index 554754eb26ff..ae895758b72c 100644
> --- a/mm/migrate_device.c
> +++ b/mm/migrate_device.c
> @@ -1204,6 +1204,12 @@ static void __migrate_device_pages(unsigned long *src_pfns,
>  					src_pfns[i] &= ~MIGRATE_PFN_MIGRATE;
>  					goto next;
>  				}
> +
> +				/*
> +				 * folio_free_swap() removed the folio from the swap
> +				 * cache. Refresh the saved mapping before migration.
> +				 */
> +				mapping = folio_mapping(folio);
>  			}
>  		} else if (folio_is_zone_device(newfolio)) {
>  			/*

LGTM

Reviewed-by: Balbir Singh <balbirs@xxxxxxxxxx>