On Wed, Aug 26, 2026 at 03:56:53PM +0800, Longlong Xia wrote: > From: Longlong Xia <[email protected]> > > The kfree_rcu shrinker decremented sc->nr_to_scan (unsigned long) > and then tested the result with <= 0. When a single CPU's object > count exceeds the remaining budget, the subtraction wraps to a large > positive value and the <= 0 comparison, which is equivalent to == 0 > for an unsigned type, never fires again. The scan loop then iterates > through every possible CPU instead of honouring the reclaim budget. > > Accumulate into freed and stop once freed >= nr_to_scan. The shrinker > core treats nr_to_scan as input-only, so dropping the decrement is > safe; freed becomes unsigned long to match the return type. > > Suggested-by: Hao Li <[email protected]> > Assisted-by: Codex:gpt-5.6-sol > Signed-off-by: Longlong Xia <[email protected]> > --- > Changes in v2: > - Rework per suggestion from Hao Li: accumulate into freed directly, > compare freed >= nr_to_scan instead of decrementing nr_to_scan, and > drop the per-CPU count local; promote freed to unsigned long. > > Link: > https://lore.kernel.org/all/[email protected]/ > --- > mm/slab_common.c | 13 +++++-------- > 1 file changed, 5 insertions(+), 8 deletions(-) >
Looks good to me. Thanks. Reviewed-by: Hao Li <[email protected]> > diff --git a/mm/slab_common.c b/mm/slab_common.c > index 657fd75776ea..e227c2ef2a4e 100644 > --- a/mm/slab_common.c > +++ b/mm/slab_common.c > @@ -2162,20 +2162,17 @@ kfree_rcu_shrink_count(struct shrinker *shrink, > struct shrink_control *sc) > static unsigned long > kfree_rcu_shrink_scan(struct shrinker *shrink, struct shrink_control *sc) > { > - int cpu, freed = 0; > + int cpu; > + unsigned long freed = 0; > > for_each_possible_cpu(cpu) { > - int count; > struct kfree_rcu_cpu *krcp = per_cpu_ptr(&krc, cpu); > > - count = krc_count(krcp); > - count += drain_page_cache(krcp); > + freed += krc_count(krcp); > + freed += drain_page_cache(krcp); > kfree_rcu_monitor(&krcp->monitor_work.work); > > - sc->nr_to_scan -= count; > - freed += count; > - > - if (sc->nr_to_scan <= 0) > + if (freed >= sc->nr_to_scan) > break; > } > > -- > 2.43.0 > -- Thanks, Hao
