[PATCH v2] mm/slab_common: fix shrink budget underflow in kfree_rcu_shrink_scan

[Longlong Xia]

From: Longlong Xia <xialonglong@xxxxxxxxxx>

The kfree_rcu shrinker decremented sc->nr_to_scan (unsigned long)
and then tested the result with <= 0. When a single CPU's object
count exceeds the remaining budget, the subtraction wraps to a large
positive value and the <= 0 comparison, which is equivalent to == 0
for an unsigned type, never fires again. The scan loop then iterates
through every possible CPU instead of honouring the reclaim budget.

Accumulate into freed and stop once freed >= nr_to_scan. The shrinker
core treats nr_to_scan as input-only, so dropping the decrement is
safe; freed becomes unsigned long to match the return type.

Suggested-by: Hao Li <hao.li@xxxxxxxxx>
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Longlong Xia <xialonglong@xxxxxxxxxx>
---
Changes in v2:
- Rework per suggestion from Hao Li: accumulate into freed directly,
  compare freed >= nr_to_scan instead of decrementing nr_to_scan, and
  drop the per-CPU count local; promote freed to unsigned long.

Link: https://lore.kernel.org/all/20260824091838.1692153-1-xialonglong2025@xxxxxxx/
---
 mm/slab_common.c | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/mm/slab_common.c b/mm/slab_common.c
index 657fd75776ea..e227c2ef2a4e 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -2162,20 +2162,17 @@ kfree_rcu_shrink_count(struct shrinker *shrink, struct shrink_control *sc)
 static unsigned long
 kfree_rcu_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
 {
-	int cpu, freed = 0;
+	int cpu;
+	unsigned long freed = 0;
 
 	for_each_possible_cpu(cpu) {
-		int count;
 		struct kfree_rcu_cpu *krcp = per_cpu_ptr(&krc, cpu);
 
-		count = krc_count(krcp);
-		count += drain_page_cache(krcp);
+		freed += krc_count(krcp);
+		freed += drain_page_cache(krcp);
 		kfree_rcu_monitor(&krcp->monitor_work.work);
 
-		sc->nr_to_scan -= count;
-		freed += count;
-
-		if (sc->nr_to_scan <= 0)
+		if (freed >= sc->nr_to_scan)
 			break;
 	}
 
-- 
2.43.0