Linux swap faults stop spinning forever on bad entries

Breno Leitao has posted kernel patches that stop a corrupt swap page-table entry from spinning a fault forever and flooding the console with the same error line.

At Meta, a handful of machines hit the failure mode after what Leitao ties to a collapse and page-table reclaim race already fixed elsewhere. The interesting fallout was operational: one host logged more than six million copies of “get_swap_device: Bad swap offset entry” in a few hours, enough to crash the fleet’s kernel monitoring path. Two independent mistakes made the cascade possible. The swap lookup printed every rejection without rate limiting, unlike nearby bad-PTE helpers. The swap fault handler then treated the failure as handled and returned success-with-retry, so nothing ever changed the bad entry and the same fault ran again.

The three-part series rate-limits the three related error prints (including one on the fork path), makes the swap-device lookup return a distinct I/O error for entries that can never name a valid slot while still returning null when swapoff is tearing a device down, and has the swap fault path deliver SIGBUS for that permanent case instead of looping. Callers that only needed to bail out still do; they simply distinguish “give up” from “try again later.”

Andrew Morton called the behaviors “pretty obnoxious” and asked to land the rate-limit change alone as a backportable stable hotfix, with the error distinction and SIGBUS change following as a short series for the next mainline cycle. Barry Song and Nhat Pham have reviewed the work. Leitao kept the rate limit even after SIGBUS stops the main retry loop, arguing other callers could still spam and that repeated copies add nothing once corruption is already clear.