Re: [PATCH v7 12/16] mm/mglru: Restrict eviction accounting to eligible zones

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] mm/mglru: premature OOM kill in lru_gen_age_node() on
  zone-constrained reclaim
--

commit 169c51ce627ac19052dda882e181615f7e7c984d
Author: Barry Song (Xiaomi) <baohua@kernel.org>

mm/mglru: Restrict eviction accounting to eligible zones

This commit restricts lruvec_evictable_size() and lru_gen_imbalanced() to
count only zones at or below sc->reclaim_idx by adding a max_zone
parameter to lruvec_gen_size().

> diff --git a/mm/vmscan.c b/mm/vmscan.c
> index 41dd77652c82f..8b77e6bc1d519 100644
> --- a/mm/vmscan.c
> +++ b/mm/vmscan.c
> @@ -4207,8 +4207,8 @@ static void set_initial_priority(struct pglist_data *pgdat, struct scan_control
>  	sc->priority = clamp(priority, DEF_PRIORITY / 2, DEF_PRIORITY);
>  }
>  
> -static void lruvec_evictable_size(struct lruvec *lruvec, int swappiness,
> -				  unsigned long nr[])
> +static void lruvec_evictable_size(struct lruvec *lruvec, struct scan_control *sc,
> +				  int swappiness, unsigned long nr[])
>  {
>  	int type;
>  	unsigned long seq;
> @@ -4221,7 +4221,7 @@ static void lruvec_evictable_size(struct lruvec *lruvec, int swappiness,
>  
>  	for_each_evictable_type(type, swappiness) {
>  		for (seq = min_seq[type]; seq <= max_seq; seq++)
> -			nr[type] += lruvec_gen_size(lrugen, type, seq);
> +			nr[type] += lruvec_gen_size(lrugen, type, seq, sc->reclaim_idx + 1);
>  	}
>  }
>  
> @@ -4230,7 +4230,7 @@ static bool lruvec_is_sizable(struct lruvec *lruvec, struct scan_control *sc)
>  	unsigned long total, sizes[ANON_AND_FILE];
>  	int swappiness = get_swappiness(lruvec, sc);
>  
> -	lruvec_evictable_size(lruvec, swappiness, sizes);
> +	lruvec_evictable_size(lruvec, sc, swappiness, sizes);
>  	total = sizes[LRU_GEN_ANON] + sizes[LRU_GEN_FILE];
>  
>  	/* whether the size is big enough to be helpful */

[Severity: High]
Can restricting lruvec_is_sizable() to sc->reclaim_idx trigger a premature
global OOM kill in lru_gen_age_node() during zone-constrained reclaim when
lru_gen_min_ttl is enabled?

In balance_pgdat(), kswapd sets sc.reclaim_idx = highest_zoneidx and runs
kswapd_age_node() -> lru_gen_age_node() before kswapd_shrink_node():

mm/vmscan.c:lru_gen_age_node() {
	...
	do {
		struct lruvec *lruvec = mem_cgroup_lruvec(memcg, pgdat);

		mem_cgroup_calculate_protection(NULL, memcg);

		if (!reclaimable)
			reclaimable = lruvec_is_reclaimable(lruvec, sc, min_ttl);
	} while ((memcg = mem_cgroup_iter(NULL, memcg, NULL)));
	...
	if (!reclaimable && mutex_trylock(&oom_lock)) {
		struct oom_control oc = {
			.gfp_mask = sc->gfp_mask,
		};

		out_of_memory(&oc);

		mutex_unlock(&oom_lock);
	}
}

Because user LRU pages are allocated from the highest zones and kept out of
lower zones by lowmem_reserve, a wakeup with a constrained highest_zoneidx
(such as ZONE_DMA or ZONE_DMA32) can find fewer than 1UL << sc->priority
evictable pages in zones 0..sc->reclaim_idx in every memcg.
lruvec_is_sizable() and lruvec_is_reclaimable() then return false for all
memcgs, causing lru_gen_age_node() to invoke out_of_memory() with
GFP_KERNEL even when higher zones have plenty of reclaimable memory older
than min_ttl.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111232603.9934-1-baohua@kernel.org?part=12