3 files changed, 53 insertions, 26 deletions

diff --git a/mm/filemap.c b/mm/filemap.c
index 96778faf82d5..645a080ba4df 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -700,10 +700,14 @@ repeat:
                 if (unlikely(!page))
                         goto out;
                 if (radix_tree_exception(page)) {
-                        if (radix_tree_exceptional_entry(page))
-                                goto out;
-                        /* radix_tree_deref_retry(page) */
-                        goto repeat;
+                        if (radix_tree_deref_retry(page))
+                                goto repeat;
+                        /*
+                         * Otherwise, shmem/tmpfs must be storing a swap entry
+                         * here as an exceptional entry: so return it without
+                         * attempting to raise page count.
+                         */
+                        goto out;
                 }
                 if (!page_cache_get_speculative(page))
                         goto repeat;
@@ -838,15 +842,21 @@ repeat:
                         continue;
 
                 if (radix_tree_exception(page)) {
-                        if (radix_tree_exceptional_entry(page))
-                                continue;
+                        if (radix_tree_deref_retry(page)) {
+                                /*
+                                 * Transient condition which can only trigger
+                                 * when entry at index 0 moves out of or back
+                                 * to root: none yet gotten, safe to restart.
+                                 */
+                                WARN_ON(start | i);
+                                goto restart;
+                        }
                         /*
-                         * radix_tree_deref_retry(page):
-                         * can only trigger when entry at index 0 moves out of
-                         * or back to root: none yet gotten, safe to restart.
+                         * Otherwise, shmem/tmpfs must be storing a swap entry
+                         * here as an exceptional entry: so skip over it -
+                         * we only reach this from invalidate_mapping_pages().
                          */
-                        WARN_ON(start | i);
-                        goto restart;
+                        continue;
                 }
 
                 if (!page_cache_get_speculative(page))
@@ -904,14 +914,20 @@ repeat:
                         continue;
 
                 if (radix_tree_exception(page)) {
-                        if (radix_tree_exceptional_entry(page))
-                                break;
+                        if (radix_tree_deref_retry(page)) {
+                                /*
+                                 * Transient condition which can only trigger
+                                 * when entry at index 0 moves out of or back
+                                 * to root: none yet gotten, safe to restart.
+                                 */
+                                goto restart;
+                        }
                         /*
-                         * radix_tree_deref_retry(page):
-                         * can only trigger when entry at index 0 moves out of
-                         * or back to root: none yet gotten, safe to restart.
+                         * Otherwise, shmem/tmpfs must be storing a swap entry
+                         * here as an exceptional entry: so stop looking for
+                         * contiguous pages.
                          */
-                        goto restart;
+                        break;
                 }
 
                 if (!page_cache_get_speculative(page))
@@ -973,13 +989,19 @@ repeat:
                         continue;
 
                 if (radix_tree_exception(page)) {
-                        BUG_ON(radix_tree_exceptional_entry(page));
+                        if (radix_tree_deref_retry(page)) {
+                                /*
+                                 * Transient condition which can only trigger
+                                 * when entry at index 0 moves out of or back
+                                 * to root: none yet gotten, safe to restart.
+                                 */
+                                goto restart;
+                        }
                         /*
-                         * radix_tree_deref_retry(page):
-                         * can only trigger when entry at index 0 moves out of
-                         * or back to root: none yet gotten, safe to restart.
+                         * This function is never used on a shmem/tmpfs
+                         * mapping, so a swap entry won't be found here.
                          */
-                        goto restart;
+                        BUG();
                 }
 
                 if (!page_cache_get_speculative(page))
diff --git a/mm/mincore.c b/mm/mincore.c
index 733f1829b0dc..636a86876ff2 100644
--- a/mm/mincore.c
+++ b/mm/mincore.c
@@ -72,6 +72,7 @@ static unsigned char mincore_page(struct address_space *mapping, pgoff_t pgoff)
          */
         page = find_get_page(mapping, pgoff);
 #ifdef CONFIG_SWAP
+        /* shmem/tmpfs may return swap: account for swapcache page too. */
         if (radix_tree_exceptional_entry(page)) {
                 swp_entry_t swap = radix_to_swp_entry(page);
                 page = find_get_page(&swapper_space, swap.val);
diff --git a/mm/shmem.c b/mm/shmem.c
index 1c702f6f1241..32f6763f16fb 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -332,10 +332,14 @@ repeat:
                 if (unlikely(!page))
                         continue;
                 if (radix_tree_exception(page)) {
-                        if (radix_tree_exceptional_entry(page))
-                                goto export;
-                        /* radix_tree_deref_retry(page) */
-                        goto restart;
+                        if (radix_tree_deref_retry(page))
+                                goto restart;
+                        /*
+                         * Otherwise, we must be storing a swap entry
+                         * here as an exceptional entry: so return it
+                         * without attempting to raise page count.
+                         */
+                        goto export;
                 }
                 if (!page_cache_get_speculative(page))
                         goto repeat;