From: Longlong Xia <[email protected]> The kfree_rcu shrinker decremented sc->nr_to_scan (unsigned long) and then tested the result with <= 0. When a single CPU's object count exceeds the remaining budget, the subtraction wraps to a large positive value and the <= 0 comparison, which is equivalent to == 0 for an unsigned type, never fires again. The scan loop then iterates through every possible CPU instead of honouring the reclaim budget.
Accumulate into freed and stop once freed >= nr_to_scan. The shrinker core treats nr_to_scan as input-only, so dropping the decrement is safe; freed becomes unsigned long to match the return type. Suggested-by: Hao Li <[email protected]> Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Longlong Xia <[email protected]> --- Changes in v2: - Rework per suggestion from Hao Li: accumulate into freed directly, compare freed >= nr_to_scan instead of decrementing nr_to_scan, and drop the per-CPU count local; promote freed to unsigned long. Link: https://lore.kernel.org/all/[email protected]/ --- mm/slab_common.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/mm/slab_common.c b/mm/slab_common.c index 657fd75776ea..e227c2ef2a4e 100644 --- a/mm/slab_common.c +++ b/mm/slab_common.c @@ -2162,20 +2162,17 @@ kfree_rcu_shrink_count(struct shrinker *shrink, struct shrink_control *sc) static unsigned long kfree_rcu_shrink_scan(struct shrinker *shrink, struct shrink_control *sc) { - int cpu, freed = 0; + int cpu; + unsigned long freed = 0; for_each_possible_cpu(cpu) { - int count; struct kfree_rcu_cpu *krcp = per_cpu_ptr(&krc, cpu); - count = krc_count(krcp); - count += drain_page_cache(krcp); + freed += krc_count(krcp); + freed += drain_page_cache(krcp); kfree_rcu_monitor(&krcp->monitor_work.work); - sc->nr_to_scan -= count; - freed += count; - - if (sc->nr_to_scan <= 0) + if (freed >= sc->nr_to_scan) break; } -- 2.43.0
