Skip to contentSkip to conversation

FAILED: patch "[PATCH] mm/damon/paddr: drop last same folio access check reuse" failed to apply to 6.12-stable tree

PATCH Applied [email protected] 4 participants 4 messages Sep 8 – Sep 9

Subsystems (3)
Stable branch Memory management DAMON
lore
Share & tools
lore

[email protected]

author maintainer
#0 lore raw

The patch below does not apply to the 6.12-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.12.y
git checkout FETCH_HEAD
git cherry-pick -x f23f0aa62b2f32c2b12f95959fc4603ef81678b2
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026090852-morally-preview-efa5@gregkh' --subject-prefix 'PATCH 6.12.y' 'HEAD^..'

Possible dependencies:

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From f23f0aa62b2f32c2b12f95959fc4603ef81678b2 Mon Sep 17 00:00:00 2001
From: SJ Park <[email protected]>
Date: Tue, 14 Jul 2026 20:09:59 -0700
Subject: [PATCH] mm/damon/paddr: drop last same folio access check reuse
optimization

It can race when multiple kdamonds are being used. The problem from the race is doubtful, but the gain from the optimization is also doubtful. Simply drop the optimization in favor of code simplicity.

The user impact is doubtfully trivial. After all, this kind of interference can happen only by intentional user setup. Even if it happens, it will be rare, and the consequence is degradation of the best-effort monitoring results. No critical consequences like kernel panic or memory corruption happen.

The race was discovered [1] by Sashiko.

Link https://lore.kernel.org/[email protected] open here
Link https://lore.kernel.org/[email protected] [1] open here
Fixes a28397beb55b ("mm/damon: implement primitives for physical address space monitoring")
Signed-off-by SJ Park <[email protected]>
Cc <[email protected]> # 5.16.x
Signed-off-by Andrew Morton <[email protected]>
mm/damon/paddr.c +4 -16
index b85f88a7a38f..e4f98d67461f 100644
@@ -65,7 +65,7 @@ static void damon_pa_prepare_access_checks(struct damon_ctx *ctx)
 	}
 }
 
-static bool damon_pa_young(phys_addr_t paddr, unsigned long *folio_sz)
+static bool damon_pa_young(phys_addr_t paddr)
 {
 	struct folio *folio = damon_get_folio(PHYS_PFN(paddr));
 	bool accessed;

@@ -74,7 +74,6 @@ static bool damon_pa_young(phys_addr_t paddr, unsigned long *folio_sz)
 		return false;
 
 	accessed = damon_folio_young(folio);
-	*folio_sz = folio_size(folio);
 	folio_put(folio);
 	return accessed;
 }

@@ -82,23 +81,12 @@ static bool damon_pa_young(phys_addr_t paddr, unsigned long *folio_sz)
 static void __damon_pa_check_access(struct damon_region *r,
 		unsigned long addr_unit)
 {
-	static phys_addr_t last_addr;
-	static unsigned long last_folio_sz = PAGE_SIZE;
-	static bool last_accessed;
+	bool accessed;
 	phys_addr_t sampling_addr = damon_pa_phys_addr(
 			r->sampling_addr, addr_unit);
 
-	/* If the region is in the last checked page, reuse the result */
-	if (ALIGN_DOWN(last_addr, last_folio_sz) ==
-				ALIGN_DOWN(sampling_addr, last_folio_sz)) {
-		damon_update_region_access_rate(r, last_accessed);
-		return;
-	}
-
-	last_accessed = damon_pa_young(sampling_addr, &last_folio_sz);
-	damon_update_region_access_rate(r, last_accessed);
-
-	last_addr = sampling_addr;
+	accessed = damon_pa_young(sampling_addr);
+	damon_update_region_access_rate(r, accessed);
 }
 
 static unsigned int damon_pa_check_accesses(struct damon_ctx *ctx)
maintainer
#1 lore raw

PATCH 1/1 mm/damon/paddr: drop last same folio access check reuse optimization

It can race when multiple kdamonds are being used. The problem from the race is doubtful, but the gain from the optimization is also doubtful. Simply drop the optimization in favor of code simplicity.

The user impact is doubtfully trivial. After all, this kind of interference can happen only by intentional user setup. Even if it happens, it will be rare, and the consequence is degradation of the best-effort monitoring results. No critical consequences like kernel panic or memory corruption happen.

The race was discovered [1] by Sashiko.

Link https://lore.kernel.org/[email protected] open here
Link https://lore.kernel.org/[email protected] [1] open here
Fixes a28397beb55b ("mm/damon: implement primitives for physical address space monitoring")
Signed-off-by SJ Park <[email protected]>
Cc <[email protected]> # 5.16.x
Signed-off-by Andrew Morton <[email protected]>
(cherry picked from commit f23f0aa62b2f32c2b12f95959fc4603ef81678b2)
Signed-off-by SJ Park <[email protected]>
---
 mm/damon/paddr.c | 20 ++++----------------
 1 file changed, 4 insertions(+), 16 deletions(-)
mm/damon/paddr.c +4 -16
index d4a4d51750f5f..a6b1de97b1e8a 100644
@@ -148,7 +148,7 @@ static bool damon_folio_young(struct folio *folio)
 	return accessed;
 }
 
-static bool damon_pa_young(unsigned long paddr, unsigned long *folio_sz)
+static bool damon_pa_young(unsigned long paddr)
 {
 	struct folio *folio = damon_get_folio(PHYS_PFN(paddr));
 	bool accessed;

@@ -157,7 +157,6 @@ static bool damon_pa_young(unsigned long paddr, unsigned long *folio_sz)
 		return false;
 
 	accessed = damon_folio_young(folio);
-	*folio_sz = folio_size(folio);
 	folio_put(folio);
 	return accessed;
 }

@@ -165,21 +164,10 @@ static bool damon_pa_young(unsigned long paddr, unsigned long *folio_sz)
 static void __damon_pa_check_access(struct damon_region *r,
 		struct damon_attrs *attrs)
 {
-	static unsigned long last_addr;
-	static unsigned long last_folio_sz = PAGE_SIZE;
-	static bool last_accessed;
-
-	/* If the region is in the last checked page, reuse the result */
-	if (ALIGN_DOWN(last_addr, last_folio_sz) ==
-				ALIGN_DOWN(r->sampling_addr, last_folio_sz)) {
-		damon_update_region_access_rate(r, last_accessed, attrs);
-		return;
-	}
-
-	last_accessed = damon_pa_young(r->sampling_addr, &last_folio_sz);
-	damon_update_region_access_rate(r, last_accessed, attrs);
+	bool accessed;
 
-	last_addr = r->sampling_addr;
+	accessed = damon_pa_young(r->sampling_addr);
+	damon_update_region_access_rate(r, accessed, attrs);
 }
 
 static unsigned int damon_pa_check_accesses(struct damon_ctx *ctx)
Signature · 1 line
2.47.3
AI review
#2 lore raw

Re: [PATCH 6.12.y] mm/damon/paddr: drop last same folio access check reuse optimization

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but it is a pre-existing TOCTOU race in damon_folio_young where an anonymous folio can be converted to a KSM folio after lockless checks, leading to rmap_walk_ksm being called without the folio lock. --

commit fca283b4eb28ba2daec6fc0d0f8aed873b1ec9ca
Author: SJ Park <[email protected]>

mm/damon/paddr: drop last same folio access check reuse optimization

This commit removes a race-prone optimization in damon's physical address monitoring that attempted to reuse access check results for the same folio. The optimization provided doubtful benefits while introducing potential races when multiple kdamonds run.

Link https://lore.kernel.org/[email protected] open here
Link https://lore.kernel.org/[email protected] [1] open here
Quoted 4 lines
mm/damon/paddr.c +0 -0
index d4a4d51750f5f..a6b1de97b1e8a 100644

[ ... ]

mm/damon/paddr.c static bool damon_pa_young(unsigned long paddr, unsigned long *folio_sz) · line 159

Quoted 4 lines
mm/damon/paddr.c +0 -0
@@ -157,7 +157,6 @@ static bool damon_pa_young(unsigned long paddr, unsigned long *folio_sz)
 		return false;
 
 	accessed = damon_folio_young(folio);

[Severity: High]
This is a pre-existing issue, but is there a time-of-check to time-of-use race in damon_folio_young() when handling anonymous folios?

When damon_pa_check_access() calls damon_pa_young(), it takes a speculative reference to the folio and calls damon_folio_young(). Inside damon_folio_young(), the need for a lock is determined locklessly:

damon_folio_young() {
        need_lock = !folio_test_anon(folio) || folio_test_ksm(folio);
        if (need_lock && !folio_trylock(folio))
                return false;
        
        rmap_walk(folio, &rwc);
}

If the ksm daemon is concurrently processing an anonymous folio, could the lockless check evaluate to false just before the ksm daemon updates the folio with the ksm flag?

If that sequence occurs, damon_folio_young() would skip acquiring the folio lock and call rmap_walk(). The rmap_walk() function would then re-evaluate the ksm flag, see it is set, and call rmap_walk_ksm() without holding the required folio lock.

Could this lead to a panic or data corruption when walking the ksm stable tree locklessly?

Quoted 4 lines
mm/damon/paddr.c +0 -1
-	*folio_sz = folio_size(folio);
 	folio_put(folio);
 	return accessed;
 }
Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1
maintainer Applied
#3 lore raw

Re: [PATCH 6.12.y] mm/damon/paddr: drop last same folio access check reuse optimization

In reply to SJ Park
Quoted 3 lines

It can race when multiple kdamonds are being used. The problem from the race is doubtful, but the gain from the optimization is also doubtful. Simply drop the optimization in favor of code simplicity.

Queued for 6.12, thanks.

Signature · 2 lines
Thanks,
Sasha