mm/damon/core: skip aging from repeated aggressive merging
Subsystems (3)
SJ Park
maintainerPATCH 1/1 mm/damon/core: skip aging from repeated aggressive merging
The number of DAMON regions could temporarily exceed the user-defined maximum number of regions limit for corner cases. For example, users could lower the limit via runtime parameters update. For such a case, kdamond_merge_regions() repeats merging regions in the case doubling the merge threshold. The repeated merge operation could update the age of regions multiple times. This corrupts the monitoring results. Fix the issue by asking the merge operation to skip aging for the corner case.
The user impact is degradation of the monitoring quality. The impact should be mild, since the degradation is only temporal, and it is not common to happen in realistic setups.
The issue was discovered [1,2] by Sashiko.
[1] https://lore.kernel.org/[email protected]
[2] https://lore.kernel.org/[email protected]
---
Changes from RFC
- RFC: https://lore.kernel.org/[email protected]
- Drop RFC tag.
mm/damon/core.c | 21 +++++++++++++-------- mm/damon/tests/core-kunit.h | 2 +- 2 files changed, 14 insertions(+), 9 deletions(-)
mm/damon/core.c +13 -8
@@ -3308,7 +3308,7 @@ static unsigned int damon_merge_score(struct damon_region *r, bool last,* sz_limit size upper limit of each region */ static void damon_merge_regions_of (struct damon_target *t,unsigned int thres, -unsigned long sz_limit,struct damon_ctx *ctx) +unsigned long sz_limit,struct damon_ctx *ctx,bool count_age) {struct damon_region *r, *prev =NULL , *next;bool use_probe_hits =damon_has_probe_weights (ctx);
@@ -3319,12 +3319,14 @@ static void damon_merge_regions_of(struct damon_target *t, unsigned int thres, score =damon_merge_score (r, false, ctx, use_probe_hits); last_score =damon_merge_score (r, true, ctx, use_probe_hits); -if (abs_diff (score, last_score) > thres) - r->age =0 ; -else if ((score ==0 ) != (last_score ==0 )) - r->age =0 ; -else - r->age++; +if (count_age) { +if (abs_diff (score, last_score) > thres) + r->age =0 ; +else if ((score ==0 ) != (last_score ==0 )) + r->age =0 ; +else + r->age++; + }if (!prev) goto set_prev_continue;
@@ -3366,15 +3368,18 @@ static void kdamond_merge_regions(struct damon_ctx *c, unsigned int threshold,struct damon_target *t;unsigned int nr_regions;unsigned int max_thres; +bool count_age = true; max_thres = c->attrs.aggr_interval / (c->attrs.sample_interval ? c->attrs.sample_interval :1 );do { nr_regions =0 ;damon_for_each_target (t, c) { -damon_merge_regions_of (t, threshold, sz_limit, c); +damon_merge_regions_of (t, threshold, sz_limit, c, + count_age); nr_regions +=damon_nr_regions (t); } + count_age = false; threshold =max (1 , threshold *2 ); }while (nr_regions > c->attrs.max_nr_regions && threshold /2 < max_thres);
mm/damon/tests/core-kunit.h +1 -1
@@ -257,7 +257,7 @@ static void damon_test_merge_regions_of(struct kunit *test)damon_add_region (r, t); } -damon_merge_regions_of (t,9 ,9999 , ctx); +damon_merge_regions_of (t,9 ,9999 , ctx, true);/* 0-112, 114-130, 130-156, 156-170, 170-230, 230-10170 */ KUNIT_EXPECT_EQ (test,damon_nr_regions (t),6u );for (i =0 ; i <6 ; i++) {
base-commit: 96e4e82548418bcd5b3518d3b4efed1f5631772e
Signature · 1 line
2.47.3
[email protected]
AI reviewThank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues:
- [High] kdamond_merge_regions() can fall into an infinite loop due to integer overflow of threshold. --
--- Patch [1]: [PATCH] mm/damon/core: skip aging from repeated aggressive merging --- commit 1fa7392cc3fc19083e90cfb01dcfa4f03ebbc373
Author: SJ Park <[email protected]>
mm/damon/core: skip aging from repeated aggressive merging
This commit modifies the DAMON core to skip aging when repeating region merges during corner cases where the number of regions exceeds the user-defined maximum limit. This prevents temporary degradation of monitoring quality caused by updating region ages multiple times during repeated merge operations.
Quoted 3 lines
mm/damon/core.c +0
-0
[ ... ]
Quoted 10 lines
mm/damon/core.c +1
-0@@ -3366,15 +3368,18 @@ static void kdamond_merge_regions(struct damon_ctx *c, unsigned int threshold,struct damon_target *t;unsigned int nr_regions;unsigned int max_thres; +bool count_age = true; max_thres = c->attrs.aggr_interval / (c->attrs.sample_interval ? c->attrs.sample_interval :1 ); do { nr_regions = 0;
mm/damon/core.c static void kdamond_merge_regions(struct damon_ctx *c, unsigned int threshold, · line 3385
Quoted 10 lines
mm/damon/core.c +3
-1damon_for_each_target (t, c) { -damon_merge_regions_of (t, threshold, sz_limit, c); +damon_merge_regions_of (t, threshold, sz_limit, c, + count_age); nr_regions +=damon_nr_regions (t); } + count_age = false; threshold =max (1 , threshold *2 ); }while (nr_regions > c->attrs.max_nr_regions && threshold /2 < max_thres);
[Severity: High]
This is a pre-existing issue, but can kdamond_merge_regions() fall into an infinite loop under certain configurations?
If a user configures aggr_interval and sample_interval such that their quotient (max_thres) exceeds 0x40000000, threshold could overflow in the max() assignment above.
Since threshold is an unsigned int, doubling it once it reaches 0x80000000 causes an overflow to 0, which max(1, 0) clamps back to 1.
If regions cannot be merged further due to the sz_limit constraint, nr_regions > c->attrs.max_nr_regions remains true indefinitely.
Because threshold cycles and never exceeds 0xFFFFFFFF, threshold / 2 never reaches max_thres, causing this loop condition to evaluate to true endlessly.
Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1
SJ Park
maintainerQuoted 54 lines · On Sun, 12 Jul 2026 17:10:20 +0000 [email protected] wrote:
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues:
- [High]kdamond_merge_regions()can fall into an infinite loop due to integer overflow ofthreshold. ----- Patch [1]: [PATCH]
mm/damon/core: skip aging from repeated aggressive merging --- commit1fa7392cc3fc19083e90cfb01dcfa4f03ebbc373
Author: SJ Park <[email protected]>
mm/damon/core: skip aging from repeated aggressive mergingThis commit modifies the DAMON core to skip aging when repeating region merges during corner cases where the number of regions exceeds the user-defined maximum limit. This prevents temporary degradation of monitoring quality caused by updating region ages multiple times during repeated merge operations.
Quoted 3 lines
mm/damon/core.c +0
-0[ ... ]
Quoted 10 lines
mm/damon/core.c +1
-0@@ -3366,15 +3368,18 @@ static void kdamond_merge_regions(struct damon_ctx *c, unsigned int threshold,struct damon_target *t;unsigned int nr_regions;unsigned int max_thres; +bool count_age = true; max_thres = c->attrs.aggr_interval / (c->attrs.sample_interval ? c->attrs.sample_interval :1 ); do { nr_regions = 0;mm/damon/core.c static void kdamond_merge_regions(struct damon_ctx *c, unsigned int threshold, · line 3385
Quoted 10 lines
mm/damon/core.c +3
-1damon_for_each_target (t, c) { -damon_merge_regions_of (t, threshold, sz_limit, c); +damon_merge_regions_of (t, threshold, sz_limit, c, + count_age); nr_regions +=damon_nr_regions (t); } + count_age = false; threshold =max (1 , threshold *2 ); }while (nr_regions > c->attrs.max_nr_regions && threshold /2 < max_thres);[Severity: High]
This is a pre-existing issue, but cankdamond_merge_regions()fall into an infinite loop under certain configurations?If a user configures
aggr_intervalandsample_intervalsuch that their quotient (max_thres) exceeds0x40000000, threshold could overflow in themax()assignment above.
Quoted 8 lines
Since threshold is an unsigned int, doubling it once it reaches
0x80000000causes an overflow to 0, whichmax(1, 0)clamps back to 1.If regions cannot be merged further due to the
sz_limitconstraint,nr_regions>c->attrs.max_nr_regionsremains true indefinitely.Because threshold cycles and never exceeds
0xFFFFFFFF, threshold / 2 never reachesmax_thres, causing this loop condition to evaluate to true endlessly.
Another patch [1] for the issue is under review.
[1] https://lore.kernel.org/[email protected]
Quoted 3 lines
Signature · 2 lines
-- Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1
Thanks,
SJ
SJ Park
maintainerQuoted 11 lines · On Sun, 12 Jul 2026 09:54:30 -0700 SJ Park <[email protected]> wrote:
The number of DAMON regions could temporarily exceed the user-defined maximum number of regions limit for corner cases. For example, users could lower the limit via runtime parameters update. For such a case,
kdamond_merge_regions()repeats merging regions in the case doubling the merge threshold. The repeated merge operation could update the age of regions multiple times. This corrupts the monitoring results. Fix the issue by asking the merge operation to skip aging for the corner case.The user impact is degradation of the monitoring quality. The impact should be mild, since the degradation is only temporal, and it is not common to happen in realistic setups.
Sashiko found no blocker for this patch. Sashiko sent findings to damon@ mailing list [1], and I replied. Please read those for details.
[1] https://lore.kernel.org/damon/
Thanks,
SJ
[...]