On 2023/7/15 11:56, Matthew Wilcox wrote: > On Sat, Jul 15, 2023 at 11:28:02AM +0800, Miaohe Lin wrote: >> When page table locked is held, the page can't be freed from under us. > > But the page isn't mapped into the page table ... there's a swap entry > in the page table, so I don't think your logic holds. > IIUC, device_private_entry will hold one page refcnt when it's set to page table. And there's similar code in do_swap_page(): vm_fault_t do_swap_page(struct vm_fault *vmf) if (unlikely(non_swap_entry(entry))) { if (is_device_private_entry(entry)) /* * Get a page reference while we know the page can't be * freed. */ get_page(vmf->page); pte_unmap_unlock(vmf->pte, vmf->ptl); ret = vmf->page->pgmap->ops->migrate_to_ram(vmf); put_page(vmf->page); ... If my logic doesn't hold, do_swap_page() will need to fix the code. Or am I miss something? Thanks Matthew.