在 2026/8/26 10:56, Hao Li 写道:
On Mon, Aug 24, 2026 at 05:18:38PM +0800, Longlong Xia wrote:
From: Longlong Xia <[email protected]>
The kfree_rcu shrinker decremented sc->nr_to_scan (unsigned long)
and then tested the result with <= 0. When a single CPU's object
count exceeds the remaining budget, the subtraction wraps to a large
positive value and the <= 0 comparison, which is equivalent to == 0
for an unsigned type, never fires again. The scan loop then iterates
through every possible CPU instead of honouring the reclaim budget.
Reorder the logic to compare count against nr_to_scan before
subtracting, so the loop exits as soon as the budget is met.
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Longlong Xia <[email protected]>
---
mm/slab_common.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/mm/slab_common.c b/mm/slab_common.c
index 657fd75776ea..95ddbab290d4 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -2172,11 +2172,11 @@ kfree_rcu_shrink_scan(struct shrinker *shrink, struct
shrink_control *sc)
count += drain_page_cache(krcp);
kfree_rcu_monitor(&krcp->monitor_work.work);
- sc->nr_to_scan -= count;
freed += count;
- if (sc->nr_to_scan <= 0)
+ if (count >= sc->nr_to_scan)
break;
+ sc->nr_to_scan -= count;
thanks, this is indeed a problem.
I think we could make the code more better, for example:
1. remove `count` variable
2. add count to freed directly (also change type to unsigned)
3. check `if (freed >= sc->nr_to_scan)` then break.
How does this sound to you?
Thanks for the reply.
Sounds good -- I'll adopt it for v2.
v2 incoming, with Suggested-by from you.
Thanks，
Longlong
