shmem_getpage_locked() / swapin_readahead() race in 2.4.4-pre3

[Marcelo Tosatti]

Hi, 

There is a nasty race between shmem_getpage_locked() and
swapin_readahead() with the new shmem code (introduced in 2.4.3-ac3 and
merged in the main tree in 2.4.4-pre3): 

shmem_getpage_locked() finds a page in the swapcache and moves it to the
pagecache as an shmem page, freeing the swapcache and the swap map entry
for this page. (which causes a BUG() in mm/shmem.c:353 since the swap
map entry is being used) 

In the meanwhile, swapin_readahead() is allocating a page and adding it to
the swapcache.

I don't see any clean fix for this one.

Suggestions ?