Re: [PATCH v2 1/2] mm/swapfile: fix list iteration when next node is removed during discard

[Chris Mason <clm@meta.com>]

On Thu, 27 Nov 2025 19:03:02 +0900 Youngjun Park <youngjun.park@lge.com> wrote:

> When the next node is removed from the plist (e.g. by swapoff),
> plist_del() makes the node point to itself, causing the iteration to
> loop on the same entry indefinitely.
> 
> Add a plist_node_empty() check to detect this case and restart
> iteration, allowing swap_sync_discard() to continue processing
> remaining swap devices that still have pending discard entries.
> 
> Additionally, switch from swap_avail_lock/swap_avail_head to
> swap_lock/swap_active_head so that iteration is only affected by
> swapoff operations rather than frequent availability changes,
> reducing exceptional condition checks and lock contention.
> 
> Fixes: 686ea517f471 ("mm, swap: do not perform synchronous discard during allocation")
> Suggested-by: Kairui Song <kasong@tencent.com>
> Acked-by: Kairui Song <kasong@tencent.com>
> Signed-off-by: Youngjun Park <youngjun.park@lge.com>
>

Hi everyone,

This fix landed upstream in v6.19-rc1:

commit f9e82f99b3771eef396dbf97e0f3c76e20af60dd
Author: Youngjun Park <youngjun.park@lge.com>
Date:   Thu Nov 27 19:03:02 2025 +0900
Subject: mm/swapfile: fix list iteration when next node is removed during discard

Looks like the commit being fixed is actually:

commit 9fb749cd15078c7bdc46e5d45c37493f83323e33
Author: Kairui Song <kasong@tencent.com>
Date:   Fri Oct 24 02:34:11 2025 +0800
Subject: mm, swap: do not perform synchronous discard during allocation

v6.18.y stable has Kairui Song's commit, but this fix hasn't made it to stable.
Johannes noticed the Fixes: tag doesn't match, which probably explains
the gap, but I think we should pull this fix (f9e82f99b) in.

> ---
>  mm/swapfile.c | 14 +++++++++-----
>  1 file changed, 9 insertions(+), 5 deletions(-)
> 
> diff --git a/mm/swapfile.c b/mm/swapfile.c
> index d12332423a06..8116f36e440b 100644
> --- a/mm/swapfile.c
> +++ b/mm/swapfile.c
> @@ -1387,9 +1387,10 @@ static bool swap_sync_discard(void)
>  	bool ret = false;
>  	struct swap_info_struct *si, *next;
>  
> -	spin_lock(&swap_avail_lock);
> -	plist_for_each_entry_safe(si, next, &swap_avail_head, avail_list) {
> -		spin_unlock(&swap_avail_lock);
> +	spin_lock(&swap_lock);
> +start_over:
> +	plist_for_each_entry_safe(si, next, &swap_active_head, list) {
> +		spin_unlock(&swap_lock);
>  		if (get_swap_device_info(si)) {
>  			if (si->flags & SWP_PAGE_DISCARD)
>  				ret = swap_do_scheduled_discard(si);
> @@ -1397,9 +1398,12 @@ static bool swap_sync_discard(void)
>  		}
>  		if (ret)
>  			return true;
> -		spin_lock(&swap_avail_lock);
> +
> +		spin_lock(&swap_lock);
> +		if (plist_node_empty(&next->list))
> +			goto start_over;
>  	}
> -	spin_unlock(&swap_avail_lock);
> +	spin_unlock(&swap_lock);
>  
>  	return false;
>  }
> -- 
> 2.34.1
> 
> 
>