When freeing a large folio, we must remove it from the deferred split list before we uncharge it as each memcg has its own deferred split list (with associated lock) and removing a folio from the deferred split list while holding the wrong lock will corrupt that list and cause various related problems. Link: https://lore.kernel.org/linux-mm/367a14f7-340e-4b29-90ae-bc3fcefdd5f4@xxxxxxx/ Fixes: f77171d241e3 (mm: allow non-hugetlb large folios to be batch processed) Debugged-by: Ryan Roberts <ryan.roberts@xxxxxxx> Signed-off-by: Matthew Wilcox (Oracle) <willy@xxxxxxxxxxxxx> Tested-by: Ryan Roberts <ryan.roberts@xxxxxxx> --- mm/swap.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mm/swap.c b/mm/swap.c index 6b697d33fa5b..7b1d3144391b 100644 --- a/mm/swap.c +++ b/mm/swap.c @@ -1012,6 +1012,8 @@ void folios_put_refs(struct folio_batch *folios, unsigned int *refs) free_huge_folio(folio); continue; } + if (folio_test_large(folio) && folio_test_large_rmappable(folio)) + folio_undo_large_rmappable(folio); __page_cache_release(folio, &lruvec, &flags); -- 2.43.0
