4 files changed, 26 insertions, 9 deletions

diff --git a/mm/shmem.c b/mm/shmem.c
index 0132fbd45a23..47ab19182287 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -1097,7 +1097,7 @@ static int shmem_writepage(struct page *page, struct writeback_control *wbc)
         shmem_swp_unmap(entry);
 unlock:
         spin_unlock(&info->lock);
-        swap_free(swap);
+        swapcache_free(swap, NULL);
 redirty:
         set_page_dirty(page);
         if (wbc->for_reclaim)
diff --git a/mm/swap_state.c b/mm/swap_state.c
index 1416e7e9e02d..19bdf3017a9e 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -162,11 +162,11 @@ int add_to_swap(struct page *page)
                         return 1;
                 case -EEXIST:
                         /* Raced with "speculative" read_swap_cache_async */
-                        swap_free(entry);
+                        swapcache_free(entry, NULL);
                         continue;
                 default:
                         /* -ENOMEM radix-tree allocation failure */
-                        swap_free(entry);
+                        swapcache_free(entry, NULL);
                         return 0;
                 }
         }
@@ -188,8 +188,7 @@ void delete_from_swap_cache(struct page *page)
         __delete_from_swap_cache(page);
         spin_unlock_irq(&swapper_space.tree_lock);
 
-        mem_cgroup_uncharge_swapcache(page, entry);
-        swap_free(entry);
+        swapcache_free(entry, page);
         page_cache_release(page);
 }
 
@@ -293,7 +292,7 @@ struct page *read_swap_cache_async(swp_entry_t entry, gfp_t gfp_mask,
                 /*
                  * Swap entry may have been freed since our caller observed it.
                  */
-                if (!swap_duplicate(entry))
+                if (!swapcache_prepare(entry))
                         break;
 
                 /*
@@ -317,7 +316,7 @@ struct page *read_swap_cache_async(swp_entry_t entry, gfp_t gfp_mask,
                 }
                 ClearPageSwapBacked(new_page);
                 __clear_page_locked(new_page);
-                swap_free(entry);
+                swapcache_free(entry, NULL);
         } while (err != -ENOMEM);
 
         if (new_page)
diff --git a/mm/swapfile.c b/mm/swapfile.c
index 312fafe0ab6e..3187079903fd 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -510,6 +510,16 @@ void swap_free(swp_entry_t entry)
 }
 
 /*
+ * Called after dropping swapcache to decrease refcnt to swap entries.
+ */
+void swapcache_free(swp_entry_t entry, struct page *page)
+{
+        if (page)
+                mem_cgroup_uncharge_swapcache(page, entry);
+        return swap_free(entry);
+}
+
+/*
  * How many references to page are currently swapped out?
  */
 static inline int page_swapcount(struct page *page)
@@ -1979,6 +1989,15 @@ bad_file:
         goto out;
 }
 
+/*
+ * Called when allocating swap cache for exising swap entry,
+ */
+int swapcache_prepare(swp_entry_t entry)
+{
+        return swap_duplicate(entry);
+}
+
+
 struct swap_info_struct *
 get_swap_info_struct(unsigned type)
 {
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 2c4b945b011f..52339dd7bf85 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -470,8 +470,7 @@ static int __remove_mapping(struct address_space *mapping, struct page *page)
                 swp_entry_t swap = { .val = page_private(page) };
                 __delete_from_swap_cache(page);
                 spin_unlock_irq(&mapping->tree_lock);
-                mem_cgroup_uncharge_swapcache(page, swap);
-                swap_free(swap);
+                swapcache_free(swap, page);
         } else {
                 __remove_from_page_cache(page);
                 spin_unlock_irq(&mapping->tree_lock);