Re: [PATCH] mm/swap_cgroup: fix kernel BUG in swap_cgroup_record

[Kairui Song <ryncsn@gmail.com>]

On Mon, Jan 12, 2026 at 11:27 PM Johannes Weiner <hannes@cmpxchg.org> wrote:
>
> On Sat, Jan 10, 2026 at 12:16:13PM +0530, Deepanshu Kartikey wrote:
> > When using MADV_PAGEOUT, pages can remain in swapcache with their swap
> > entries assigned. If MADV_PAGEOUT is called again on these pages,
>
> This doesn't add up to me - maybe I'm missing something.
>
> memcg1_swapout() is called at the very end of reclaim, from
> __remove_mapping(), which *removes the folio from swapcache*. At this
> point the folio is exclusive to *that* thread - there are no more
> present ptes that another madvise could even be acting on.
>
> How could we reach here twice for the same swap entry?
>
> It seems more likely that we're missing a swapin notification, fail to
> clear the swap entry from the cgroup records, and then trip up when
> the entry is recycled to a totally different page down the line. No?

Thank you so much for Ccing me!

Deepanshu's patch is helpful but that's not the root cause. I did see
the problem locally sometime ago, but I completely forgot about this
one :(

I think the following fix should be good?

diff --git a/mm/vmscan.c b/mm/vmscan.c
index 453d654727c1..e8b5b8f514ab 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -758,8 +758,8 @@ static int __remove_mapping(struct address_space
*mapping, struct folio *folio,

                if (reclaimed && !mapping_exiting(mapping))
                        shadow = workingset_eviction(folio, target_memcg);
-               __swap_cache_del_folio(ci, folio, swap, shadow);
                memcg1_swapout(folio, swap);
+               __swap_cache_del_folio(ci, folio, swap, shadow);
                swap_cluster_unlock_irq(ci);
        } else {
                void (*free_folio)(struct folio *);

---

It's caused by https://lore.kernel.org/linux-mm/20251220-swap-table-p2-v5-12-8862a265a033@tencent.com/

Before that patch, if the folio's swap entries are already freed and
have swap count of zero, memcg1_swapout records a stalled value but
the put_swap_folio below will clear the cgroup info as it frees the
folio's swap slots. After that commit, put_swap_folio is merged into
__swap_cache_del_folio so the stalled value will stay.