debugobjects: Fix conditions in fill_pool()

commit 684d28feb8546d1e9597aa363c3bfcf52fe250b7 upstream.

fill_pool() uses 'obj_pool_min_free' to decide whether objects should be
handed back to the kmem cache. But 'obj_pool_min_free' records the lowest
historical value of the number of objects in the object pool and not the
minimum number of objects which should be kept in the pool.

Use 'debug_objects_pool_min_level' instead, which holds the minimum number
which was scaled to the number of CPUs at boot time.

[ tglx: Massage change log ]

Fixes: d26bf5056fc0 ("debugobjects: Reduce number of pool_lock acquisitions in fill_pool()")
Fixes: 36c4ead6f6df ("debugobjects: Add global free list and the counter")
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/20240904133944.2124-3-thunder.leizhen@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/lib/debugobjects.c b/lib/debugobjects.c
index 7cea91e193a8f0423afa6cf52617a7d8b6ab40e8..1ea8af72849cdb14381a11afc628135e59239b01 100644 (file)
--- a/lib/debugobjects.c
+++ b/lib/debugobjects.c
@@ -142,13 +142,14 @@ static void fill_pool(void)
         * READ_ONCE()s pair with the WRITE_ONCE()s in pool_lock critical
         * sections.
         */
-       while (READ_ONCE(obj_nr_tofree) && (READ_ONCE(obj_pool_free) < obj_pool_min_free)) {
+       while (READ_ONCE(obj_nr_tofree) &&
+              READ_ONCE(obj_pool_free) < debug_objects_pool_min_level) {
                raw_spin_lock_irqsave(&pool_lock, flags);
                /*
                 * Recheck with the lock held as the worker thread might have
                 * won the race and freed the global free list already.
                 */
-               while (obj_nr_tofree && (obj_pool_free < obj_pool_min_free)) {
+               while (obj_nr_tofree && (obj_pool_free < debug_objects_pool_min_level)) {
                        obj = hlist_entry(obj_to_free.first, typeof(*obj), node);
                        hlist_del(&obj->node);
                        WRITE_ONCE(obj_nr_tofree, obj_nr_tofree - 1);