Skip to contentSkip to conversation

mm/damon/core: skip aging from repeated aggressive merging

PATCH Applied SJ Park 2 participants 4 messages Jul 12

Subsystems (3)
lore
Share & tools
lore

SJ Park

author maintainer
#0 lore raw

PATCH 1/1 mm/damon/core: skip aging from repeated aggressive merging

The number of DAMON regions could temporarily exceed the user-defined maximum number of regions limit for corner cases. For example, users could lower the limit via runtime parameters update. For such a case, kdamond_merge_regions() repeats merging regions in the case doubling the merge threshold. The repeated merge operation could update the age of regions multiple times. This corrupts the monitoring results. Fix the issue by asking the merge operation to skip aging for the corner case.

The user impact is degradation of the monitoring quality. The impact should be mild, since the degradation is only temporal, and it is not common to happen in realistic setups.

The issue was discovered [1,2] by Sashiko.

[1] https://lore.kernel.org/[email protected]
[2] https://lore.kernel.org/[email protected]

Fixes 310d6c15e910 ("mm/damon/core: merge regions aggressively when max_nr_regions is unmet")
Cc <[email protected]> # 6.10

---
Changes from RFC
- RFC: https://lore.kernel.org/[email protected]
- Drop RFC tag.

 mm/damon/core.c             | 21 +++++++++++++--------
 mm/damon/tests/core-kunit.h |  2 +-
 2 files changed, 14 insertions(+), 9 deletions(-)
mm/damon/core.c +13 -8
index 806a67d02a6e9..6c4215cc809ec 100644
@@ -3308,7 +3308,7 @@ static unsigned int damon_merge_score(struct damon_region *r, bool last,
  * sz_limit	size upper limit of each region
  */
 static void damon_merge_regions_of(struct damon_target *t, unsigned int thres,
-		unsigned long sz_limit, struct damon_ctx *ctx)
+		unsigned long sz_limit, struct damon_ctx *ctx, bool count_age)
 {
 	struct damon_region *r, *prev = NULL, *next;
 	bool use_probe_hits = damon_has_probe_weights(ctx);
@@ -3319,12 +3319,14 @@ static void damon_merge_regions_of(struct damon_target *t, unsigned int thres,
 		score = damon_merge_score(r, false, ctx, use_probe_hits);
 		last_score = damon_merge_score(r, true, ctx, use_probe_hits);
 
-		if (abs_diff(score, last_score) > thres)
-			r->age = 0;
-		else if ((score == 0) != (last_score == 0))
-			r->age = 0;
-		else
-			r->age++;
+		if (count_age) {
+			if (abs_diff(score, last_score) > thres)
+				r->age = 0;
+			else if ((score == 0) != (last_score == 0))
+				r->age = 0;
+			else
+				r->age++;
+		}
 
 		if (!prev)
 			goto set_prev_continue;
@@ -3366,15 +3368,18 @@ static void kdamond_merge_regions(struct damon_ctx *c, unsigned int threshold,
 	struct damon_target *t;
 	unsigned int nr_regions;
 	unsigned int max_thres;
+	bool count_age = true;
 
 	max_thres = c->attrs.aggr_interval /
 		(c->attrs.sample_interval ?  c->attrs.sample_interval : 1);
 	do {
 		nr_regions = 0;
 		damon_for_each_target(t, c) {
-			damon_merge_regions_of(t, threshold, sz_limit, c);
+			damon_merge_regions_of(t, threshold, sz_limit, c,
+					count_age);
 			nr_regions += damon_nr_regions(t);
 		}
+		count_age = false;
 		threshold = max(1, threshold * 2);
 	} while (nr_regions > c->attrs.max_nr_regions &&
 			threshold / 2 < max_thres);
mm/damon/tests/core-kunit.h +1 -1
index 6ad73559dd8ea..68d30648c612e 100644
@@ -257,7 +257,7 @@ static void damon_test_merge_regions_of(struct kunit *test)
 		damon_add_region(r, t);
 	}
 
-	damon_merge_regions_of(t, 9, 9999, ctx);
+	damon_merge_regions_of(t, 9, 9999, ctx, true);
 	/* 0-112, 114-130, 130-156, 156-170, 170-230, 230-10170 */
 	KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 6u);
 	for (i = 0; i < 6; i++) {

base-commit: 96e4e82548418bcd5b3518d3b4efed1f5631772e

Signature · 1 line
2.47.3
#1 lore raw
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] kdamond_merge_regions() can fall into an infinite loop due to integer overflow of threshold. --

--- Patch [1]: [PATCH] mm/damon/core: skip aging from repeated aggressive merging --- commit 1fa7392cc3fc19083e90cfb01dcfa4f03ebbc373
Author: SJ Park <[email protected]>

mm/damon/core: skip aging from repeated aggressive merging

This commit modifies the DAMON core to skip aging when repeating region merges during corner cases where the number of regions exceeds the user-defined maximum limit. This prevents temporary degradation of monitoring quality caused by updating region ages multiple times during repeated merge operations.

Quoted 3 lines
mm/damon/core.c +0 -0

[ ... ]

Quoted 10 lines
mm/damon/core.c +1 -0
@@ -3366,15 +3368,18 @@ static void kdamond_merge_regions(struct damon_ctx *c, unsigned int threshold,
 	struct damon_target *t;
 	unsigned int nr_regions;
 	unsigned int max_thres;
+	bool count_age = true;
 
 	max_thres = c->attrs.aggr_interval /
 		(c->attrs.sample_interval ?  c->attrs.sample_interval : 1);
 	do {
 		nr_regions = 0;

mm/damon/core.c static void kdamond_merge_regions(struct damon_ctx *c, unsigned int threshold, · line 3385

Quoted 10 lines
mm/damon/core.c +3 -1
 		damon_for_each_target(t, c) {
-			damon_merge_regions_of(t, threshold, sz_limit, c);
+			damon_merge_regions_of(t, threshold, sz_limit, c,
+					count_age);
 			nr_regions += damon_nr_regions(t);
 		}
+		count_age = false;
 		threshold = max(1, threshold * 2);
 	} while (nr_regions > c->attrs.max_nr_regions &&
 			threshold / 2 < max_thres);

[Severity: High]
This is a pre-existing issue, but can kdamond_merge_regions() fall into an infinite loop under certain configurations?

If a user configures aggr_interval and sample_interval such that their quotient (max_thres) exceeds 0x40000000, threshold could overflow in the max() assignment above.

Since threshold is an unsigned int, doubling it once it reaches 0x80000000 causes an overflow to 0, which max(1, 0) clamps back to 1.

If regions cannot be merged further due to the sz_limit constraint, nr_regions > c->attrs.max_nr_regions remains true indefinitely.

Because threshold cycles and never exceeds 0xFFFFFFFF, threshold / 2 never reaches max_thres, causing this loop condition to evaluate to true endlessly.

Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1
author maintainer
#2 lore raw
Quoted 54 lines · On Sun, 12 Jul 2026 17:10:20 +0000 [email protected] wrote:

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] kdamond_merge_regions() can fall into an infinite loop due to integer overflow of threshold. --

--- Patch [1]: [PATCH] mm/damon/core: skip aging from repeated aggressive merging --- commit 1fa7392cc3fc19083e90cfb01dcfa4f03ebbc373
Author: SJ Park <[email protected]>

mm/damon/core: skip aging from repeated aggressive merging

This commit modifies the DAMON core to skip aging when repeating region merges during corner cases where the number of regions exceeds the user-defined maximum limit. This prevents temporary degradation of monitoring quality caused by updating region ages multiple times during repeated merge operations.

Quoted 3 lines
mm/damon/core.c +0 -0

[ ... ]

Quoted 10 lines
mm/damon/core.c +1 -0
@@ -3366,15 +3368,18 @@ static void kdamond_merge_regions(struct damon_ctx *c, unsigned int threshold,
 	struct damon_target *t;
 	unsigned int nr_regions;
 	unsigned int max_thres;
+	bool count_age = true;
 
 	max_thres = c->attrs.aggr_interval /
 		(c->attrs.sample_interval ?  c->attrs.sample_interval : 1);
 	do {
 		nr_regions = 0;

mm/damon/core.c static void kdamond_merge_regions(struct damon_ctx *c, unsigned int threshold, · line 3385

Quoted 10 lines
mm/damon/core.c +3 -1
 		damon_for_each_target(t, c) {
-			damon_merge_regions_of(t, threshold, sz_limit, c);
+			damon_merge_regions_of(t, threshold, sz_limit, c,
+					count_age);
 			nr_regions += damon_nr_regions(t);
 		}
+		count_age = false;
 		threshold = max(1, threshold * 2);
 	} while (nr_regions > c->attrs.max_nr_regions &&
 			threshold / 2 < max_thres);

[Severity: High]
This is a pre-existing issue, but can kdamond_merge_regions() fall into an infinite loop under certain configurations?

If a user configures aggr_interval and sample_interval such that their quotient (max_thres) exceeds 0x40000000, threshold could overflow in the max() assignment above.

Quoted 8 lines

Since threshold is an unsigned int, doubling it once it reaches 0x80000000 causes an overflow to 0, which max(1, 0) clamps back to 1.

If regions cannot be merged further due to the sz_limit constraint, nr_regions > c->attrs.max_nr_regions remains true indefinitely.

Because threshold cycles and never exceeds 0xFFFFFFFF, threshold / 2 never reaches max_thres, causing this loop condition to evaluate to true endlessly.

Another patch [1] for the issue is under review.

[1] https://lore.kernel.org/[email protected]

Quoted 3 lines
Signature · 2 lines
-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1

Thanks,
SJ

author maintainer
#3 lore raw
In reply to SJ Park
Quoted 11 lines · On Sun, 12 Jul 2026 09:54:30 -0700 SJ Park <[email protected]> wrote:

The number of DAMON regions could temporarily exceed the user-defined maximum number of regions limit for corner cases. For example, users could lower the limit via runtime parameters update. For such a case, kdamond_merge_regions() repeats merging regions in the case doubling the merge threshold. The repeated merge operation could update the age of regions multiple times. This corrupts the monitoring results. Fix the issue by asking the merge operation to skip aging for the corner case.

The user impact is degradation of the monitoring quality. The impact should be mild, since the degradation is only temporal, and it is not common to happen in realistic setups.

Sashiko found no blocker for this patch. Sashiko sent findings to damon@ mailing list [1], and I replied. Please read those for details.

[1] https://lore.kernel.org/damon/

Thanks,
SJ

[...]