Re: [PATCH v4] mm/migrate_device: Clear stale mapping after freeing swapcache

[Balbir Singh]

On 7/28/26 4:28 PM, Arvind Yadav wrote:
> __migrate_device_pages() reads the folio mapping before calling
> folio_free_swap(). When folio_free_swap() succeeds, the folio is removed
> from the swap cache, but the saved mapping still points to swap_space.
> 
> Passing the stale mapping to folio_migrate_mapping() makes it use the
> mapped-folio path for a folio that is no longer in swapcache. It can
> then operate on swap_space.i_pages with invalid reference accounting,
> eventually triggering a folio reference count BUG.
> 
> After a successful split, nr still contains the number of pages in the
> original large folio, although each resulting page is now a separate
> order-0 folio. Reset nr to 1 so each split folio is processed separately,
> including its own swapcache removal and mapping lookup.
> 
> Refresh the saved mapping after folio_free_swap() so the current folio
> state is used during migration.
> 
> v2:
> - Refresh the mapping using folio_mapping(), as suggested by Zi Yan.
> 
> v3:
> - Reset nr to 1 after a successful split so each resulting folio is
>   processed independently, as suggested by Zi Yan.
> 
> v4:
> - Re-read each source folio's mapping immediately before
>   folio_migrate_mapping(), as suggested by Balbir Singh.
> - Add a warning to validate the post-split order-0 invariant,
>   as suggested by Balbir Singh.
> 
> Fixes: df263d9a7dff ("mm/migrate_device: try to handle swapcache pages")
> Cc: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
> Cc: David Hildenbrand <david@xxxxxxxxxx>
> Cc: Matthew Brost <matthew.brost@xxxxxxxxx>
> Cc: Joshua Hahn <joshua.hahnjy@xxxxxxxxx>
> Cc: Rakie Kim <rakie.kim@xxxxxx>
> Cc: Byungchul Park <byungchul@xxxxxx>
> Cc: Gregory Price <gourry@xxxxxxxxxx>
> Cc: Ying Huang <ying.huang@xxxxxxxxxxxxxxxxx>
> Cc: Alistair Popple <apopple@xxxxxxxxxx>
> Reviewed-by: Zi Yan <ziy@xxxxxxxxxx>
> Reviewed-by: Balbir Singh <balbirs@xxxxxxxxxx>
> Signed-off-by: Arvind Yadav <arvind.yadav@xxxxxxxxx>
> ---
>  mm/migrate_device.c | 13 +++++++++++++
>  1 file changed, 13 insertions(+)
> 
Reviewed-by: Balbir Singh <balbirs@xxxxxxxxxx>