Re: [PATCH v8 12/16] mm/mglru: Restrict eviction accounting to eligible zones

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] mm/mglru: broken min_ttl and low-zone OOM checks in
  lruvec_is_reclaimable()
--

commit 4a520d7db30ed5c782371c3ef4bdf4fd79c1de3e
Author: Barry Song (Xiaomi) <baohua@kernel.org>

mm/mglru: Restrict eviction accounting to eligible zones

This commit restricts lruvec_evictable_size() and lru_gen_imbalanced() to
count only zones up to sc->reclaim_idx, and defers the lruvec_is_sizable()
check in lruvec_is_reclaimable() to low priorities when sc->reclaim_idx is
at least ZONE_NORMAL.

> diff --git a/mm/vmscan.c b/mm/vmscan.c
> index 9071f8889b5c4..6ed47089a3305 100644
> --- a/mm/vmscan.c
> +++ b/mm/vmscan.c
> @@ -4205,8 +4205,8 @@ static void set_initial_priority(struct pglist_data *pgdat, struct scan_control
>  	sc->priority = clamp(priority, DEF_PRIORITY / 2, DEF_PRIORITY);
>  }
>  
> -static void lruvec_evictable_size(struct lruvec *lruvec, int swappiness,
> -				  unsigned long nr[])
> +static void lruvec_evictable_size(struct lruvec *lruvec, struct scan_control *sc,
> +				  int swappiness, unsigned long nr[])
>  {
>  	int type;
>  	unsigned long seq;
> @@ -4219,7 +4219,7 @@ static void lruvec_evictable_size(struct lruvec *lruvec, int swappiness,
>  
>  	for_each_evictable_type(type, swappiness) {
>  		for (seq = min_seq[type]; seq <= max_seq; seq++)
> -			nr[type] += lruvec_gen_size(lrugen, type, seq);
> +			nr[type] += lruvec_gen_size(lrugen, type, seq, sc->reclaim_idx + 1);
>  	}
>  }
>  
> @@ -4228,7 +4228,7 @@ static bool lruvec_is_sizable(struct lruvec *lruvec, struct scan_control *sc)
>  	unsigned long total, sizes[ANON_AND_FILE];
>  	int swappiness = get_swappiness(lruvec, sc);
>  
> -	lruvec_evictable_size(lruvec, swappiness, sizes);
> +	lruvec_evictable_size(lruvec, sc, swappiness, sizes);
>  	total = sizes[LRU_GEN_ANON] + sizes[LRU_GEN_FILE];
>  
>  	/* whether the size is big enough to be helpful */
> @@ -4247,7 +4247,13 @@ static bool lruvec_is_reclaimable(struct lruvec *lruvec, struct scan_control *sc
>  	if (mem_cgroup_below_min(NULL, memcg))
>  		return false;
>  
> -	if (!lruvec_is_sizable(lruvec, sc))
> +	/*
> +	 * As in __alloc_pages_may_oom(), avoid triggering OOM for low-zone
> +	 * allocations. Also, defer the LRU size check until reclaim reaches
> +	 * a very low priority to avoid premature OOM.
> +	 */
> +	if (sc->priority <= 1 && sc->reclaim_idx >= ZONE_NORMAL &&
> +	    !lruvec_is_sizable(lruvec, sc))
>  		return false;
>  
>  	gen = lru_gen_from_seq(evictable_min_seq(min_seq, swappiness));

[Severity: High]
Does skipping lruvec_is_sizable() at sc->priority > 1 bypass min_ttl_ms
working-set protection whenever any empty memcg exists?

For a memcg with no evictable pages (such as root_mem_cgroup or non-leaf
slice cgroups like system.slice under cgroup v2), lru_gen_prepare_scan()
computes a zero scan budget, so try_to_shrink_lruvec() never ages it and
lrugen.timestamps[0] remains at its creation time.  At priorities
DEF_PRIORITY down to 2, lruvec_is_sizable() is no longer called to filter
out empty memcgs, so any empty memcg older than min_ttl returns true from
time_is_before_jiffies(birth + min_ttl) and sets reclaimable = true in
lru_gen_age_node():

mm/vmscan.c:lru_gen_age_node() {
	...
		if (!reclaimable)
			reclaimable = lruvec_is_reclaimable(lruvec, sc, min_ttl);
	} while ((memcg = mem_cgroup_iter(NULL, memcg, NULL)));

	if (!reclaimable && mutex_trylock(&oom_lock)) {
		struct oom_control oc = {
			.gfp_mask = sc->gfp_mask,
		};

		out_of_memory(&oc);
}

kswapd_shrink_node() then runs and evicts folios from active memcgs even
when all of their generations are younger than min_ttl, satisfying reclaim
before sc.priority reaches 1.

In addition, checking sc->reclaim_idx >= ZONE_NORMAL only around
!lruvec_is_sizable() does not prevent low-zone OOM kills: when
sc->reclaim_idx < ZONE_NORMAL and all memcgs have timestamps younger than
min_ttl, lruvec_is_reclaimable() still returns false and lru_gen_age_node()
still calls out_of_memory().

Finally, because lruvec_evictable_size() now sums only zones up to
sc->reclaim_idx, if kswapd reclaims with sc.reclaim_idx == ZONE_NORMAL when
user LRU folios sit in ZONE_MOVABLE or ZONE_HIGHMEM and ZONE_NORMAL has
fewer than 2 evictable pages per memcg, sc.priority drops to 1 and
lruvec_is_sizable() returns false for all memcgs, triggering a global OOM
kill while higher zones have reclaimable memory older than min_ttl.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261113185541.70203-1-baohua@kernel.org?part=12