2 files changed, 10 insertions, 8 deletions

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index a7ecf23150c5..0ed61e27d526 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1169,10 +1169,11 @@ void mem_cgroup_commit_charge_swapin(struct page *page, struct mem_cgroup *ptr)
         /*
          * Now swap is on-memory. This means this page may be
          * counted both as mem and swap....double count.
-         * Fix it by uncharging from memsw. This SwapCache is stable
-         * because we're still under lock_page().
+         * Fix it by uncharging from memsw. Basically, this SwapCache is stable
+         * under lock_page(). But in do_swap_page()::memory.c, reuse_swap_page()
+         * may call delete_from_swap_cache() before reach here.
          */
-        if (do_swap_account) {
+        if (do_swap_account && PageSwapCache(page)) {
                 swp_entry_t ent = {.val = page_private(page)};
                 struct mem_cgroup *memcg;
                 memcg = swap_cgroup_record(ent, NULL);
diff --git a/mm/memory.c b/mm/memory.c
index e5bfbe6b594c..e009ce870859 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -2457,22 +2457,23 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
          * while the page is counted on swap but not yet in mapcount i.e.
          * before page_add_anon_rmap() and swap_free(); try_to_free_swap()
          * must be called after the swap_free(), or it will never succeed.
-         * And mem_cgroup_commit_charge_swapin(), which uses the swp_entry
-         * in page->private, must be called before reuse_swap_page(),
-         * which may delete_from_swap_cache().
+         * Because delete_from_swap_page() may be called by reuse_swap_page(),
+         * mem_cgroup_commit_charge_swapin() may not be able to find swp_entry
+         * in page->private. In this case, a record in swap_cgroup  is silently
+         * discarded at swap_free().
          */
 
-        mem_cgroup_commit_charge_swapin(page, ptr);
         inc_mm_counter(mm, anon_rss);
         pte = mk_pte(page, vma->vm_page_prot);
         if (write_access && reuse_swap_page(page)) {
                 pte = maybe_mkwrite(pte_mkdirty(pte), vma);
                 write_access = 0;
         }
-
         flush_icache_page(vma, page);
         set_pte_at(mm, address, page_table, pte);
         page_add_anon_rmap(page, vma, address);
+        /* It's better to call commit-charge after rmap is established */
+        mem_cgroup_commit_charge_swapin(page, ptr);
 
         swap_free(entry);
         if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))