FAILED: patch "[PATCH] mm/damon/core: skip aging from repeated aggressive merging" failed to apply to 6.1-stable tree

PATCH Applied [email protected] 4 participants 4 messages Sep 8 – Sep 11

Subsystems (3)

Stable branch Memory management DAMON

lore

Share & tools

lore

[email protected]

author maintainer

2026-09-08 12:57 UTC #0 lore raw

The patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x 0250dbe08c730d003ef9f484da56ae09a1ea0c4c
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026090841-catfight-alkalize-108d@gregkh' --subject-prefix 'PATCH 6.1.y' 'HEAD^..'

Possible dependencies:

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 0250dbe08c730d003ef9f484da56ae09a1ea0c4c Mon Sep 17 00:00:00 2001
From: SJ Park <[email protected]>
Date: Sun, 12 Jul 2026 09:54:30 -0700
Subject: [PATCH] mm/damon/core: skip aging from repeated aggressive merging

The number of DAMON regions could temporarily exceed the user-defined maximum number of regions limit for corner cases. For example, users could lower the limit via runtime parameters update. For such a case, kdamond_merge_regions() repeats merging regions in the case doubling the merge threshold. The repeated merge operation could update the age of regions multiple times. This corrupts the monitoring results. Fix the issue by asking the merge operation to skip aging for the corner case.

The user impact is degradation of the monitoring quality. The impact should be mild, since the degradation is only temporal, and it is not common to happen in realistic setups.

The issue was discovered [1,2] by Sashiko.

Link https://lore.kernel.org/[email protected] open here

Link https://lore.kernel.org/[email protected] [1] open here

Link https://lore.kernel.org/[email protected] [2] open here

Fixes 310d6c15e910 ("mm/damon/core: merge regions aggressively when max_nr_regions is unmet")

Signed-off-by SJ Park <[email protected]>

Cc <[email protected]> # 6.10

Signed-off-by Andrew Morton <[email protected]>

mm/damon/core.c +13 -8

index 806a67d02a6e..6c4215cc809e 100644
@@ -3308,7 +3308,7 @@ static unsigned int damon_merge_score(struct damon_region *r, bool last,
  * sz_limit	size upper limit of each region
  */
 static void damon_merge_regions_of(struct damon_target *t, unsigned int thres,
-		unsigned long sz_limit, struct damon_ctx *ctx)
+		unsigned long sz_limit, struct damon_ctx *ctx, bool count_age)
 {
 	struct damon_region *r, *prev = NULL, *next;
 	bool use_probe_hits = damon_has_probe_weights(ctx);

@@ -3319,12 +3319,14 @@ static void damon_merge_regions_of(struct damon_target *t, unsigned int thres,
 		score = damon_merge_score(r, false, ctx, use_probe_hits);
 		last_score = damon_merge_score(r, true, ctx, use_probe_hits);
 
-		if (abs_diff(score, last_score) > thres)
-			r->age = 0;
-		else if ((score == 0) != (last_score == 0))
-			r->age = 0;
-		else
-			r->age++;
+		if (count_age) {
+			if (abs_diff(score, last_score) > thres)
+				r->age = 0;
+			else if ((score == 0) != (last_score == 0))
+				r->age = 0;
+			else
+				r->age++;
+		}
 
 		if (!prev)
 			goto set_prev_continue;

@@ -3366,15 +3368,18 @@ static void kdamond_merge_regions(struct damon_ctx *c, unsigned int threshold,
 	struct damon_target *t;
 	unsigned int nr_regions;
 	unsigned int max_thres;
+	bool count_age = true;
 
 	max_thres = c->attrs.aggr_interval /
 		(c->attrs.sample_interval ?  c->attrs.sample_interval : 1);
 	do {
 		nr_regions = 0;
 		damon_for_each_target(t, c) {
-			damon_merge_regions_of(t, threshold, sz_limit, c);
+			damon_merge_regions_of(t, threshold, sz_limit, c,
+					count_age);
 			nr_regions += damon_nr_regions(t);
 		}
+		count_age = false;
 		threshold = max(1, threshold * 2);
 	} while (nr_regions > c->attrs.max_nr_regions &&
 			threshold / 2 < max_thres);

mm/damon/tests/core-kunit.h +1 -1

index 73cb8fcdf07e..485472ddebd1 100644
@@ -257,7 +257,7 @@ static void damon_test_merge_regions_of(struct kunit *test)
 		damon_add_region(r, t);
 	}
 
-	damon_merge_regions_of(t, 9, 9999, ctx);
+	damon_merge_regions_of(t, 9, 9999, ctx, true);
 	/* 0-112, 114-130, 130-156, 156-170, 170-230, 230-10170 */
 	KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 6u);
 	for (i = 0; i < 6; i++) {

SJ Park

maintainer

2026-09-09 04:44 UTC #1 lore raw

PATCH 1/1 mm/damon/core: skip aging from repeated aggressive merging

The user impact is degradation of the monitoring quality. The impact should be mild, since the degradation is only temporal, and it is not common to happen in realistic setups.

The issue was discovered [1,2] by Sashiko.

Link https://lore.kernel.org/[email protected] open here

Link https://lore.kernel.org/[email protected] [1] open here

Link https://lore.kernel.org/[email protected] [2] open here

Fixes 310d6c15e910 ("mm/damon/core: merge regions aggressively when max_nr_regions is unmet")

Signed-off-by SJ Park <[email protected]>

Cc <[email protected]> # 6.10

Signed-off-by Andrew Morton <[email protected]>

(cherry picked from commit 0250dbe08c730d003ef9f484da56ae09a1ea0c4c)

Signed-off-by SJ Park <[email protected]>

---
 mm/damon/core-test.h |  2 +-
 mm/damon/core.c      | 17 +++++++++++------
 2 files changed, 12 insertions(+), 7 deletions(-)

mm/damon/core-test.h +1 -1

index d8fef225930a5..cbdf3c8e45c75 100644
@@ -250,7 +250,7 @@ static void damon_test_merge_regions_of(struct kunit *test)
 		damon_add_region(r, t);
 	}
 
-	damon_merge_regions_of(t, 9, 9999);
+	damon_merge_regions_of(t, 9, 9999, true);
 	/* 0-112, 114-130, 130-156, 156-170 */
 	KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 5u);
 	for (i = 0; i < 5; i++) {

mm/damon/core.c +11 -6

index dd4eafe8b9611..859a6a636ab0e 100644
@@ -940,15 +940,17 @@ static void damon_merge_two_regions(struct damon_target *t,
  * sz_limit	size upper limit of each region
  */
 static void damon_merge_regions_of(struct damon_target *t, unsigned int thres,
-				   unsigned long sz_limit)
+		unsigned long sz_limit, bool count_age)
 {
 	struct damon_region *r, *prev = NULL, *next;
 
 	damon_for_each_region_safe(r, next, t) {
-		if (abs(r->nr_accesses - r->last_nr_accesses) > thres)
-			r->age = 0;
-		else
-			r->age++;
+		if (count_age) {
+			if (abs(r->nr_accesses - r->last_nr_accesses) > thres)
+				r->age = 0;
+			else
+				r->age++;
+		}
 
 		if (prev && prev->ar.end == r->ar.start &&
 		    abs(prev->nr_accesses - r->nr_accesses) <= thres &&

@@ -982,15 +984,18 @@ static void kdamond_merge_regions(struct damon_ctx *c, unsigned int threshold,
 	struct damon_target *t;
 	unsigned int nr_regions;
 	unsigned int max_thres;
+	bool count_age = true;
 
 	max_thres = c->attrs.aggr_interval /
 		(c->attrs.sample_interval ?  c->attrs.sample_interval : 1);
 	do {
 		nr_regions = 0;
 		damon_for_each_target(t, c) {
-			damon_merge_regions_of(t, threshold, sz_limit);
+			damon_merge_regions_of(t, threshold, sz_limit,
+					count_age);
 			nr_regions += damon_nr_regions(t);
 		}
+		count_age = false;
 		threshold = max(1, threshold * 2);
 	} while (nr_regions > c->attrs.max_nr_regions &&
 			threshold / 2 < max_thres);

Signature · 1 line

2.47.3

[email protected]

AI review

2026-09-09 04:56 UTC #2 lore raw

Re: [PATCH 6.1.y] mm/damon/core: skip aging from repeated aggressive merging

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] The kdamond_merge_regions loop can run infinitely if max_thres is extremely large and sz_limit restricts further merges, leading to a permanent kernel thread soft lockup due to a 32-bit unsigned int overflow.
- [High] Arithmetic integer overflow during weighted average calculations in damon_merge_two_regions on 32-bit systems causes severe corruption of nr_accesses and age metrics.
--

commit 1486ebcac154b450386db76101ad72341a5b5805
Author: SJ Park <[email protected]>
Subject: mm/damon/core: skip aging from repeated aggressive merging

This commit modifies kdamond_merge_regions() to skip updating region ages during repeated aggressive merges. This prevents temporal degradation of monitoring quality when the maximum number of regions limit is temporarily exceeded.

Link https://lore.kernel.org/[email protected] open here

Link https://lore.kernel.org/[email protected] [1] open here

Link https://lore.kernel.org/[email protected] [2] open here

mm/damon/core.c static void damon_merge_two_regions(struct damon_target *t,

Quoted 5 lines

mm/damon/core.c +0 -0

index dd4eafe8b9611..859a6a636ab0e 100644
@@ -940,15 +940,17 @@ static void damon_merge_two_regions(struct damon_target *t,

[Severity: High]
This isn't a bug introduced by this patch, but could this cause silent corruption of the region access counts and ages on 32-bit systems?

In damon_merge_two_regions(), the weighted average calculations are:

    l->nr_accesses = (l->nr_accesses * sz_l + r->nr_accesses * sz_r) /
                    (sz_l + sz_r);
    l->age = (l->age * sz_l + r->age * sz_r) / (sz_l + sz_r);

If a region size is very large (e.g., 100 megabytes) and nr_accesses is 45 or greater, the product of l->nr_accesses * sz_l and l->age * sz_l will exceed 4.29 billion. This overflows the 32-bit maximum before the division occurs, truncating the weighted sum and storing incorrect values in the merged region.

Quoted 6 lines

mm/damon/core.c +1 -1

  * sz_limit	size upper limit of each region
  */
 static void damon_merge_regions_of(struct damon_target *t, unsigned int thres,
-				   unsigned long sz_limit)
+		unsigned long sz_limit, bool count_age)
 {

[ ... ]

Quoted 10 lines

mm/damon/core.c +1 -0

@@ -982,15 +984,18 @@ static void kdamond_merge_regions(struct damon_ctx *c, unsigned int threshold,
 	struct damon_target *t;
 	unsigned int nr_regions;
 	unsigned int max_thres;
+	bool count_age = true;
 
 	max_thres = c->attrs.aggr_interval /
 		(c->attrs.sample_interval ?  c->attrs.sample_interval : 1);
 	do {
 		nr_regions = 0;

mm/damon/core.c static void kdamond_merge_regions(struct damon_ctx *c, unsigned int threshold, · line 1001

Quoted 10 lines

mm/damon/core.c +3 -1

 		damon_for_each_target(t, c) {
-			damon_merge_regions_of(t, threshold, sz_limit);
+			damon_merge_regions_of(t, threshold, sz_limit,
+					count_age);
 			nr_regions += damon_nr_regions(t);
 		}
+		count_age = false;
 		threshold = max(1, threshold * 2);
 	} while (nr_regions > c->attrs.max_nr_regions &&
 			threshold / 2 < max_thres);

[Severity: High]
This is a pre-existing issue, but can this loop run infinitely if max_thres is extremely large and merges are blocked?

If a privileged user sets a very large aggr_interval relative to sample_interval such that max_thres exceeds 2^30 (1,073,741,824), and merges are blocked by size limits, threshold will continually double.

Because threshold is a 32-bit unsigned int, once it reaches 2^31, threshold * 2 will overflow to 0, which max(1, 0) will reset to 1. Then threshold / 2 becomes 0.

This causes the exit condition threshold / 2 < max_thres to remain perpetually true while nr_regions never drops, resulting in a permanent kernel thread soft lockup.

Signature · 1 line

Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1

Sasha Levin

maintainer Applied

2026-09-11 11:21 UTC #3 lore raw

Re: [PATCH 6.1.y] mm/damon/core: skip aging from repeated aggressive merging

In reply to SJ Park

Quoted 3 lines

The number of DAMON regions could temporarily exceed the user-defined maximum number of regions limit for corner cases. For example, users could lower the limit via runtime parameters update.

Queued for 6.1, thanks.

Signature · 2 lines

Thanks,
Sasha