From: Longlong Xia <[email protected]> The kfree_rcu shrinker decremented sc->nr_to_scan (unsigned long) and then tested the result with <= 0. When a single CPU's object count exceeds the remaining budget, the subtraction wraps to a large positive value and the <= 0 comparison, which is equivalent to == 0 for an unsigned type, never fires again. The scan loop then iterates through every possible CPU instead of honouring the reclaim budget.
Reorder the logic to compare count against nr_to_scan before subtracting, so the loop exits as soon as the budget is met. Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Longlong Xia <[email protected]> --- mm/slab_common.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mm/slab_common.c b/mm/slab_common.c index 657fd75776ea..95ddbab290d4 100644 --- a/mm/slab_common.c +++ b/mm/slab_common.c @@ -2172,11 +2172,11 @@ kfree_rcu_shrink_scan(struct shrinker *shrink, struct shrink_control *sc) count += drain_page_cache(krcp); kfree_rcu_monitor(&krcp->monitor_work.work); - sc->nr_to_scan -= count; freed += count; - if (sc->nr_to_scan <= 0) + if (count >= sc->nr_to_scan) break; + sc->nr_to_scan -= count; } return freed == 0 ? SHRINK_STOP : freed; -- 2.43.0
