Add a swap branch in __split_huge_pmd_locked() that splits a PMD swap entry into 512 PTE swap entries. No folio reference is needed because swap entries point to swap slots rather than pages. Each PTE inherits the correct sub-slot offset and preserves soft_dirty, uffd_wp, and exclusive flags. The folio_remove_rmap_pmd() gate at the end must inspect old_pmd rather than *pmd: for a present THP split, *pmd has already been cleared by pmdp_invalidate(), and that invalidated bit pattern can decode as a plausible swap entry. This branch is reached from the explicit __split_huge_pmd() callers that hit a non-present PMD: partial-range mprotect / munmap, the wp_huge_pmd() PMD-COW fallback, and the swap-in / swapoff fallbacks added in later patches when the cached folio is no longer PMD-sized. page_vma_mapped_walk() does not iterate PMD swap entries, so try_to_unmap_one() and try_to_migrate_one() do not reach this branch and freeze=true cannot occur in this branch today. page and folio are therefore left uninitialized in the swap branch; a VM_WARN_ON_ONCE(freeze) catches any future caller that breaks this invariant before the freeze path dereferences page_to_pfn(page + i) or put_page(page). Signed-off-by: Usama Arif --- mm/huge_memory.c | 29 ++++++++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 1b6b0aa2baa3b..a473e85d30f51 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -3252,6 +3252,14 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd, folio_add_anon_rmap_ptes(folio, page, HPAGE_PMD_NR, vma, haddr, rmap_flags); } + } else if (pmd_is_swap_entry(*pmd)) { + VM_WARN_ON_ONCE(freeze); + /* Swap entries have no page for the migration freeze path. */ + freeze = false; + old_pmd = *pmd; + soft_dirty = pmd_swp_soft_dirty(old_pmd); + uffd_wp = pmd_swp_uffd(old_pmd); + anon_exclusive = pmd_swp_exclusive(old_pmd); } else { /* * Up to this point the pmd is present and huge and userland has @@ -3388,6 +3396,25 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd, VM_WARN_ON(!pte_none(ptep_get(pte + i))); set_pte_at(mm, addr, pte + i, entry); } + } else if (pmd_is_swap_entry(old_pmd)) { + softleaf_t sl_entry = softleaf_from_pmd(old_pmd); + pte_t swp_pte; + swp_entry_t sub_entry; + + for (i = 0, addr = haddr; i < HPAGE_PMD_NR; + i++, addr += PAGE_SIZE) { + sub_entry = swp_entry(swp_type(sl_entry), + swp_offset(sl_entry) + i); + swp_pte = swp_entry_to_pte(sub_entry); + if (soft_dirty) + swp_pte = pte_swp_mksoft_dirty(swp_pte); + if (uffd_wp) + swp_pte = pte_swp_mkuffd(swp_pte); + if (anon_exclusive) + swp_pte = pte_swp_mkexclusive(swp_pte); + VM_WARN_ON(!pte_none(ptep_get(pte + i))); + set_pte_at(mm, addr, pte + i, swp_pte); + } } else { pte_t entry; @@ -3415,7 +3442,7 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd, } pte_unmap(pte); - if (!pmd_is_migration_entry(*pmd)) + if (!pmd_is_migration_entry(old_pmd) && !pmd_is_swap_entry(old_pmd)) folio_remove_rmap_pmd(folio, page, vma); if (freeze) put_page(page); -- 2.53.0-Meta