On Mon, Aug 24, 2026 at 05:18:38PM +0800, Longlong Xia wrote: > From: Longlong Xia <[email protected]> > > The kfree_rcu shrinker decremented sc->nr_to_scan (unsigned long) > and then tested the result with <= 0. When a single CPU's object > count exceeds the remaining budget, the subtraction wraps to a large > positive value and the <= 0 comparison, which is equivalent to == 0 > for an unsigned type, never fires again. The scan loop then iterates > through every possible CPU instead of honouring the reclaim budget. > > Reorder the logic to compare count against nr_to_scan before > subtracting, so the loop exits as soon as the budget is met. > > Assisted-by: Codex:gpt-5.6-sol > Signed-off-by: Longlong Xia <[email protected]> > --- > mm/slab_common.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/mm/slab_common.c b/mm/slab_common.c > index 657fd75776ea..95ddbab290d4 100644 > --- a/mm/slab_common.c > +++ b/mm/slab_common.c > @@ -2172,11 +2172,11 @@ kfree_rcu_shrink_scan(struct shrinker *shrink, struct > shrink_control *sc) > count += drain_page_cache(krcp); > kfree_rcu_monitor(&krcp->monitor_work.work); > > - sc->nr_to_scan -= count; > freed += count; > > - if (sc->nr_to_scan <= 0) > + if (count >= sc->nr_to_scan) > break; > + sc->nr_to_scan -= count;
thanks, this is indeed a problem. I think we could make the code more better, for example: 1. remove `count` variable 2. add count to freed directly (also change type to unsigned) 3. check `if (freed >= sc->nr_to_scan)` then break. How does this sound to you? -- Thanks, Hao
