Re: [PATCH v2 0/4] mm, swap: keep hibernation swap slots out of the swap cache

[Andrew Morton]

On Sun,  9 Aug 2026 23:45:55 +0900 Youngjun Park <youngjun.park@xxxxxxx> wrote:

> Cluster readahead walks a raw page_cluster sized window of offsets around
> the faulting entry.  A hibernation slot looks like an ordinary swapped out
> slot, so __swap_cache_add_check() lets it in.  Readahead reads the offset
> off the device into a folio and puts that folio in the swap table where the
> hibernation entry was.  This has been possible for a long time.  It only
> wasted a folio and a read.
> 
> That changed with commit 0d6af9bcf383 ("mm, swap: use the swap table to
> track the swap count").  A slot with a folio in the swap cache should only
> be freed when the folio leaves the cache.  swap_put_entries_cluster() still
> does that, but the conversion left swap_free_hibernation_slot() freeing the
> slot either way.  Nothing points at the folio after that, and when reclaim
> drops it later, it writes to the table entry at the old offset, which
> someone else may own by then.
> 
> Patch 1 is the fix and the only patch for stable.  It puts the missing
> check back, so both free paths behave the same again.
> 
> The rest removes the cause.  Readahead should not touch these slots at all,
> so patch 2 lets only swapped out slots into the swap cache, which also puts
> back a bad slot check the swap cache rework dropped, patch 3 gives
> hibernation slots their own swap table entry type so that check covers them
> too, and patch 4 drops the guard and the reclaim, since no such folio can
> exist any more.

Thanks.  It's late and review is only partial.  I'd prefer to wait
until after 7.3-rc1 to process this series.

AI review suggests that more such fixing is needed in
__swap_cache_add_check():
	https://sashiko.dev/#/patchset/20260809144559.2104856-1-youngjun.park@xxxxxxx