Re: [PATCH v2 13/14] mm/shmem: fix accounting of swapin-error markers

[Baolin Wang]

On 10/27/26 9:03 PM, David Hildenbrand (Arm) wrote:
> A failed swap read replaces the swap entry with a swapin-error marker in
> the page-cache and subtracts its pages from "alloced" and "swapped";
> however, it leaves their block charge in place.
>
> Removing the marker during truncate then subtracts from "swapped" again.
> This can underflow the counters or make swapped reach zero while other
> pages remain swapped out, causing swapoff to loop without finding them.
>
> When installing the marker, subtract only from "swapped" and let
> shmem_recalc_inode() reduce "alloced" and release the block charge.
>
> Make shmem_free_swap() report successful removal separately from the
> number of swap pages freed, so removing a swapin-error marker does not
> subtract from "swapped" again.
>
> It's a bit confusing, but replacing a swapped out page by a swapin-error
> marker in shmem_set_folio_swapin_error() behaves as follows:
>
> Initially:
> 	alloced=1, swapped=1, nrpages=0
> Calling shmem_recalc_inode(inode, 0, -1)
> 	-> swapped = 0
> 	-> freed =  1 - 0 - 0 = 1
> 	-> alloced -= freed
> 	-> alloced=0, swapped=0, block charge released
>
> Fixes: 6cec2b95dadf ("mm/shmem: fix infinite loop when swap in shmem error at swapoff time")
> Cc: stable@xxxxxxxxxxxxxxx
> Tested-by: Gregory Price (Meta) <gourry@xxxxxxxxxx>
> Signed-off-by: David Hildenbrand (Arm) <david@xxxxxxxxxx>
> ---

Good catch. LGTM.
Reviewed-by: Baolin Wang <baolin.wang@xxxxxxxxxxxxxxxxx>