[PATCH] shmem: clamp negative used-block samples in statfs

[PATCH] shmem: clamp negative used-block samples in statfs

[Hungyu Lin]

percpu_counter_sum() holds the counter lock while scanning the per-CPU
values, but local updates can still proceed. Concurrent allocation and
freeing on different CPUs can therefore produce a negative sample even
though the number of used tmpfs blocks cannot be negative.

shmem_statfs() subtracts this sample from max_blocks, reporting more free
blocks than the filesystem's total. With a one-page file being written
and truncated on separate CPUs, GNU df reports negative used space, for
example 67108864 total bytes, -28672 used and 67137536 available.

Use percpu_counter_sum_positive() to clamp a negative sample to zero.
This retains the approximate accounting and does not change allocation
or limit enforcement.

Fixes: 7e496299d4d2 ("tmpfs: make tmpfs scalable with percpu_counter for used blocks")
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
---
 mm/shmem.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/shmem.c b/mm/shmem.c
index d97fc32e7c94..092bb45a076c 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -4005,7 +4005,7 @@ static int shmem_statfs(struct dentry *dentry, struct kstatfs *buf)
 		buf->f_blocks = sbinfo->max_blocks;
 		buf->f_bavail =
 		buf->f_bfree  = sbinfo->max_blocks -
-				percpu_counter_sum(&sbinfo->used_blocks);
+				percpu_counter_sum_positive(&sbinfo->used_blocks);
 	}
 	if (sbinfo->max_inodes) {
 		buf->f_files = sbinfo->max_inodes;
-- 
2.43.0

Re: [PATCH] shmem: clamp negative used-block samples in statfs

[Tim Chen]

On Tue, 2026-10-27 at 16:36 +0000, Hungyu Lin wrote:
> percpu_counter_sum() holds the counter lock while scanning the per-CPU
> values, but local updates can still proceed. Concurrent allocation and
> freeing on different CPUs can therefore produce a negative sample even
> though the number of used tmpfs blocks cannot be negative.
> 
> shmem_statfs() subtracts this sample from max_blocks, reporting more free
> blocks than the filesystem's total. With a one-page file being written
> and truncated on separate CPUs, GNU df reports negative used space, for
> example 67108864 total bytes, -28672 used and 67137536 available.
> 
> Use percpu_counter_sum_positive() to clamp a negative sample to zero.
> This retains the approximate accounting and does not change allocation

Nit: I wouldn't call this "approximate". percpu_counter_sum() is the
best-effort accurate variant: it adds up fbc->count and all the per-CPU
deltas under fbc->lock. The lock only excludes batch folds, though, not
the lockless local updates, so a free on one CPU racing with the scan
can make the sum briefly dip below zero. If an approximate value were
fine, percpu_counter_read() would have been used instead.

Maybe something like:

    This keeps the existing best-effort accounting in statfs and does not
    change allocation or limit enforcement.

Otherwise the change looks good to me.

Reviewed-by: Tim Chen <tim.c.chen@linux.intel.com>

Tim

> or limit enforcement.
> 
> Fixes: 7e496299d4d2 ("tmpfs: make tmpfs scalable with percpu_counter for used blocks")
> Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
> ---
>  mm/shmem.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/mm/shmem.c b/mm/shmem.c
> index d97fc32e7c94..092bb45a076c 100644
> --- a/mm/shmem.c
> +++ b/mm/shmem.c
> @@ -4005,7 +4005,7 @@ static int shmem_statfs(struct dentry *dentry, struct kstatfs *buf)
>  		buf->f_blocks = sbinfo->max_blocks;
>  		buf->f_bavail =
>  		buf->f_bfree  = sbinfo->max_blocks -
> -				percpu_counter_sum(&sbinfo->used_blocks);
> +				percpu_counter_sum_positive(&sbinfo->used_blocks);
>  	}
>  	if (sbinfo->max_inodes) {
>  		buf->f_files = sbinfo->max_inodes;