It is not legal to have NULL pointers in a folio_batch. However, the Ceph code does exactly this, and a refactoring patch gone wrong has exposed this to folios_put_refs(), see https://lore.kernel.org/ceph-devel/aK4v548CId5GIKG1@swift.blarg.de/ I believe this should Oops instead of crashing due to NULL pointer reference (guarded by is_huge_zero_folio(), which may silently hide the bug). Signed-off-by: Max Kellermann --- mm/swap.c | 1 + 1 file changed, 1 insertion(+) diff --git a/mm/swap.c b/mm/swap.c index 3632dd061beb..07ccda00e7ee 100644 --- a/mm/swap.c +++ b/mm/swap.c @@ -952,6 +952,7 @@ void folios_put_refs(struct folio_batch *folios, unsigned int *refs) for (i = 0, j = 0; i < folios->nr; i++) { struct folio *folio = folios->folios[i]; unsigned int nr_refs = refs ? refs[i] : 1; + BUG_ON(folio == NULL); if (is_huge_zero_folio(folio)) continue; -- 2.47.2