[PATCH 1/1] mm/slab_common: fix shrink budget underflow in kfree_rcu_shrink_scan

[PATCH 1/1] mm/slab_common: fix shrink budget underflow in kfree_rcu_shrink_scan

[Longlong Xia]

From: Longlong Xia <xialonglong@kylinos.cn>

The kfree_rcu shrinker decremented sc->nr_to_scan (unsigned long)
and then tested the result with <= 0. When a single CPU's object
count exceeds the remaining budget, the subtraction wraps to a large
positive value and the <= 0 comparison, which is equivalent to == 0
for an unsigned type, never fires again. The scan loop then iterates
through every possible CPU instead of honouring the reclaim budget.

Reorder the logic to compare count against nr_to_scan before
subtracting, so the loop exits as soon as the budget is met.

Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Longlong Xia <xialonglong@kylinos.cn>
---
 mm/slab_common.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/mm/slab_common.c b/mm/slab_common.c
index 657fd75776ea..95ddbab290d4 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -2172,11 +2172,11 @@ kfree_rcu_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
 		count += drain_page_cache(krcp);
 		kfree_rcu_monitor(&krcp->monitor_work.work);
 
-		sc->nr_to_scan -= count;
 		freed += count;
 
-		if (sc->nr_to_scan <= 0)
+		if (count >= sc->nr_to_scan)
 			break;
+		sc->nr_to_scan -= count;
 	}
 
 	return freed == 0 ? SHRINK_STOP : freed;
-- 
2.43.0

Re: [PATCH 1/1] mm/slab_common: fix shrink budget underflow in kfree_rcu_shrink_scan

[Hao Li]

On Mon, Aug 24, 2026 at 05:18:38PM +0800, Longlong Xia wrote:
> From: Longlong Xia <xialonglong@kylinos.cn>
> 
> The kfree_rcu shrinker decremented sc->nr_to_scan (unsigned long)
> and then tested the result with <= 0. When a single CPU's object
> count exceeds the remaining budget, the subtraction wraps to a large
> positive value and the <= 0 comparison, which is equivalent to == 0
> for an unsigned type, never fires again. The scan loop then iterates
> through every possible CPU instead of honouring the reclaim budget.
> 
> Reorder the logic to compare count against nr_to_scan before
> subtracting, so the loop exits as soon as the budget is met.
> 
> Assisted-by: Codex:gpt-5.6-sol
> Signed-off-by: Longlong Xia <xialonglong@kylinos.cn>
> ---
>  mm/slab_common.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/mm/slab_common.c b/mm/slab_common.c
> index 657fd75776ea..95ddbab290d4 100644
> --- a/mm/slab_common.c
> +++ b/mm/slab_common.c
> @@ -2172,11 +2172,11 @@ kfree_rcu_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
>  		count += drain_page_cache(krcp);
>  		kfree_rcu_monitor(&krcp->monitor_work.work);
>  
> -		sc->nr_to_scan -= count;
>  		freed += count;
>  
> -		if (sc->nr_to_scan <= 0)
> +		if (count >= sc->nr_to_scan)
>  			break;
> +		sc->nr_to_scan -= count;

thanks, this is indeed a problem.
I think we could make the code more better, for example:

1. remove `count` variable
2. add count to freed directly (also change type to unsigned)
3. check `if (freed >= sc->nr_to_scan)` then break.

How does this sound to you?

-- 
Thanks,
Hao

Re: [PATCH 1/1] mm/slab_common: fix shrink budget underflow in kfree_rcu_shrink_scan

[Longlong Xia]

在 2026/8/26 10:56, Hao Li 写道:
> On Mon, Aug 24, 2026 at 05:18:38PM +0800, Longlong Xia wrote:
>> From: Longlong Xia <xialonglong@kylinos.cn>
>>
>> The kfree_rcu shrinker decremented sc->nr_to_scan (unsigned long)
>> and then tested the result with <= 0. When a single CPU's object
>> count exceeds the remaining budget, the subtraction wraps to a large
>> positive value and the <= 0 comparison, which is equivalent to == 0
>> for an unsigned type, never fires again. The scan loop then iterates
>> through every possible CPU instead of honouring the reclaim budget.
>>
>> Reorder the logic to compare count against nr_to_scan before
>> subtracting, so the loop exits as soon as the budget is met.
>>
>> Assisted-by: Codex:gpt-5.6-sol
>> Signed-off-by: Longlong Xia <xialonglong@kylinos.cn>
>> ---
>>   mm/slab_common.c | 4 ++--
>>   1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/mm/slab_common.c b/mm/slab_common.c
>> index 657fd75776ea..95ddbab290d4 100644
>> --- a/mm/slab_common.c
>> +++ b/mm/slab_common.c
>> @@ -2172,11 +2172,11 @@ kfree_rcu_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
>>   		count += drain_page_cache(krcp);
>>   		kfree_rcu_monitor(&krcp->monitor_work.work);
>>   
>> -		sc->nr_to_scan -= count;
>>   		freed += count;
>>   
>> -		if (sc->nr_to_scan <= 0)
>> +		if (count >= sc->nr_to_scan)
>>   			break;
>> +		sc->nr_to_scan -= count;
> thanks, this is indeed a problem.
> I think we could make the code more better, for example:
>
> 1. remove `count` variable
> 2. add count to freed directly (also change type to unsigned)
> 3. check `if (freed >= sc->nr_to_scan)` then break.
>
> How does this sound to you?
Thanks for the reply.

Sounds good -- I'll adopt it for v2.

v2 incoming, with Suggested-by from you.


Thanks，

Longlong