FAILED: patch "[PATCH] mm/damon/core: skip aging from repeated aggressive merging" failed to apply to 6.12-stable tree
Subsystems (3)
[email protected]
maintainerThe patch below does not apply to the 6.12-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.12.y
git checkout FETCH_HEAD
git cherry-pick -x 0250dbe08c730d003ef9f484da56ae09a1ea0c4c
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026090840-slapstick-viability-4dbd@gregkh' --subject-prefix 'PATCH 6.12.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 0250dbe08c730d003ef9f484da56ae09a1ea0c4c Mon Sep 17 00:00:00 2001
From: SJ Park <[email protected]>
Date: Sun, 12 Jul 2026 09:54:30 -0700
Subject: [PATCH] mm/damon/core: skip aging from repeated aggressive merging
The number of DAMON regions could temporarily exceed the user-defined maximum number of regions limit for corner cases. For example, users could lower the limit via runtime parameters update. For such a case, kdamond_merge_regions() repeats merging regions in the case doubling the merge threshold. The repeated merge operation could update the age of regions multiple times. This corrupts the monitoring results. Fix the issue by asking the merge operation to skip aging for the corner case.
The user impact is degradation of the monitoring quality. The impact should be mild, since the degradation is only temporal, and it is not common to happen in realistic setups.
The issue was discovered [1,2] by Sashiko.
mm/damon/core.c +13 -8
@@ -3308,7 +3308,7 @@ static unsigned int damon_merge_score(struct damon_region *r, bool last,* sz_limit size upper limit of each region */ static void damon_merge_regions_of (struct damon_target *t,unsigned int thres, -unsigned long sz_limit,struct damon_ctx *ctx) +unsigned long sz_limit,struct damon_ctx *ctx,bool count_age) {struct damon_region *r, *prev =NULL , *next;bool use_probe_hits =damon_has_probe_weights (ctx);
@@ -3319,12 +3319,14 @@ static void damon_merge_regions_of(struct damon_target *t, unsigned int thres, score =damon_merge_score (r, false, ctx, use_probe_hits); last_score =damon_merge_score (r, true, ctx, use_probe_hits); -if (abs_diff (score, last_score) > thres) - r->age =0 ; -else if ((score ==0 ) != (last_score ==0 )) - r->age =0 ; -else - r->age++; +if (count_age) { +if (abs_diff (score, last_score) > thres) + r->age =0 ; +else if ((score ==0 ) != (last_score ==0 )) + r->age =0 ; +else + r->age++; + }if (!prev) goto set_prev_continue;
@@ -3366,15 +3368,18 @@ static void kdamond_merge_regions(struct damon_ctx *c, unsigned int threshold,struct damon_target *t;unsigned int nr_regions;unsigned int max_thres; +bool count_age = true; max_thres = c->attrs.aggr_interval / (c->attrs.sample_interval ? c->attrs.sample_interval :1 );do { nr_regions =0 ;damon_for_each_target (t, c) { -damon_merge_regions_of (t, threshold, sz_limit, c); +damon_merge_regions_of (t, threshold, sz_limit, c, + count_age); nr_regions +=damon_nr_regions (t); } + count_age = false; threshold =max (1 , threshold *2 ); }while (nr_regions > c->attrs.max_nr_regions && threshold /2 < max_thres);
mm/damon/tests/core-kunit.h +1 -1
@@ -257,7 +257,7 @@ static void damon_test_merge_regions_of(struct kunit *test)damon_add_region (r, t); } -damon_merge_regions_of (t,9 ,9999 , ctx); +damon_merge_regions_of (t,9 ,9999 , ctx, true);/* 0-112, 114-130, 130-156, 156-170, 170-230, 230-10170 */ KUNIT_EXPECT_EQ (test,damon_nr_regions (t),6u );for (i =0 ; i <6 ; i++) {
SJ Park
maintainerPATCH 1/1 mm/damon/core: skip aging from repeated aggressive merging
The number of DAMON regions could temporarily exceed the user-defined maximum number of regions limit for corner cases. For example, users could lower the limit via runtime parameters update. For such a case, kdamond_merge_regions() repeats merging regions in the case doubling the merge threshold. The repeated merge operation could update the age of regions multiple times. This corrupts the monitoring results. Fix the issue by asking the merge operation to skip aging for the corner case.
The user impact is degradation of the monitoring quality. The impact should be mild, since the degradation is only temporal, and it is not common to happen in realistic setups.
The issue was discovered [1,2] by Sashiko.
--- mm/damon/core.c | 17 +++++++++++------ mm/damon/tests/core-kunit.h | 2 +- 2 files changed, 12 insertions(+), 7 deletions(-)
mm/damon/core.c +11 -6
@@ -1786,15 +1786,17 @@ static void damon_merge_two_regions(struct damon_target *t,* sz_limit size upper limit of each region */ static void damon_merge_regions_of (struct damon_target *t,unsigned int thres, -unsigned long sz_limit) +unsigned long sz_limit,bool count_age) {struct damon_region *r, *prev =NULL , *next;damon_for_each_region_safe (r, next, t) { -if (abs (r->nr_accesses - r->last_nr_accesses) > thres) - r->age =0 ; -else - r->age++; +if (count_age) { +if (abs (r->nr_accesses - r->last_nr_accesses) > thres) + r->age =0 ; +else + r->age++; + } if (prev && prev->ar.end == r->ar.start && abs(prev->nr_accesses - r->nr_accesses) <= thres &&
@@ -1828,15 +1830,18 @@ static void kdamond_merge_regions(struct damon_ctx *c, unsigned int threshold,struct damon_target *t;unsigned int nr_regions;unsigned int max_thres; +bool count_age = true; max_thres = c->attrs.aggr_interval / (c->attrs.sample_interval ? c->attrs.sample_interval :1 );do { nr_regions =0 ;damon_for_each_target (t, c) { -damon_merge_regions_of (t, threshold, sz_limit); +damon_merge_regions_of (t, threshold, sz_limit, + count_age); nr_regions +=damon_nr_regions (t); } + count_age = false; threshold =max (1 , threshold *2 ); }while (nr_regions > c->attrs.max_nr_regions && threshold /2 < max_thres);
mm/damon/tests/core-kunit.h +1 -1
@@ -261,7 +261,7 @@ static void damon_test_merge_regions_of(struct kunit *test)damon_add_region (r, t); } -damon_merge_regions_of (t,9 ,9999 ); +damon_merge_regions_of (t,9 ,9999 , true);/* 0-112, 114-130, 130-156, 156-170 */ KUNIT_EXPECT_EQ (test,damon_nr_regions (t),5u );for (i =0 ; i <5 ; i++) {
Signature · 1 line
2.47.3
[email protected]
AI reviewRe: [PATCH 6.12.y] mm/damon/core: skip aging from repeated aggressive merging
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
Pre-existing issues:
- [High] The do-while loop in kdamond_merge_regions can infinite-loop if nr_regions remains above max_nr_regions. It expects the loop to terminate when threshold / 2 >= max_thres, but threshold is a 32-bit unsigned int that overflows when doubled. If max_thres (derived from aggr_interval / sample_interval) is sufficiently large (e.g., > 1,073,741,824), the condition threshold / 2 < max_thres evaluates to true forever, locking up the kernel thread.
- [Medium] The C macro abs() is incorrectly used to compute the absolute difference between two unsigned int access counts (r->nr_accesses, r->last_nr_accesses, and prev->nr_accesses). For very large differences (exceeding 2 billion), unsigned wrap-around causes the result to evaluate as a negative 32-bit signed integer inside abs(), which negates it to a completely inaccurate value, causing DAMON to incorrectly reset region ages or improperly merge disjoint access patterns. --
commit 2e588ff7cb5f9fc59f1692ecf781e53ba68d8c92
Author: SJ Park <[email protected]>
mm/damon/core: skip aging from repeated aggressive merging
This commit fixes a corner case where kdamond_merge_regions() repeats merging regions and updates region ages multiple times, which corrupts monitoring results. It resolves the issue by skipping age counting during the repeated merge operations.
Quoted 9 lines
mm/damon/core.c +1
-1@@ -1786,15 +1786,17 @@ static void damon_merge_two_regions(struct damon_target *t,* sz_limit size upper limit of each region */ static void damon_merge_regions_of (struct damon_target *t,unsigned int thres, -unsigned long sz_limit) +unsigned long sz_limit,bool count_age)
mm/damon/core.c static void damon_merge_two_regions(struct damon_target *t, · line 1795
Quoted 10 lines
mm/damon/core.c +2
-4{struct damon_region *r, *prev =NULL , *next;damon_for_each_region_safe (r, next, t) { -if (abs (r->nr_accesses - r->last_nr_accesses) > thres) - r->age =0 ; -else - r->age++; +if (count_age) { +if (abs (r->nr_accesses - r->last_nr_accesses) > thres)
[Severity: Medium]
This is a pre-existing issue, but does using the abs() macro here correctly handle the absolute difference for large unsigned integer access counters?
For very large differences exceeding 2 billion, the unsigned wrap-around could cause the result to evaluate as a negative 32-bit signed integer inside abs(), which then negates it to an inaccurate positive value.
Could this cause DAMON to incorrectly reset region ages or improperly merge disjoint access patterns when the ratio of aggr_interval to sample_interval is very large? Would abs_diff() be a safer alternative here?
mm/damon/core.c static void damon_merge_two_regions(struct damon_target *t, · line 1802
Quoted 7 lines
mm/damon/core.c +4
-0+ r->age =0 ; + else + r->age++; + } if (prev && prev->ar.end == r->ar.start && abs(prev->nr_accesses - r->nr_accesses) <= thres &&
[Severity: Medium]
This is a pre-existing issue, but similarly, could this abs() calculation result in false positives during the threshold check, forcing aggressive merges of disparate regions if the access frequencies are extremely large?
Quoted 6 lines
mm/damon/core.c +0
-0damon_sz_region(prev) + damon_sz_region(r) <= sz_limit)damon_merge_two_regions (t, prev, r); else prev = r; } }
[ ... ]
Quoted 10 lines
mm/damon/core.c +1
-0@@ -1828,15 +1830,18 @@ static void kdamond_merge_regions(struct damon_ctx *c, unsigned int threshold,struct damon_target *t;unsigned int nr_regions;unsigned int max_thres; +bool count_age = true; max_thres = c->attrs.aggr_interval / (c->attrs.sample_interval ? c->attrs.sample_interval :1 ); do { nr_regions = 0;
mm/damon/core.c static void kdamond_merge_regions(struct damon_ctx *c, unsigned int threshold, · line 1847
Quoted 10 lines
mm/damon/core.c +3
-1damon_for_each_target (t, c) { -damon_merge_regions_of (t, threshold, sz_limit); +damon_merge_regions_of (t, threshold, sz_limit, + count_age); nr_regions +=damon_nr_regions (t); } + count_age = false; threshold =max (1 , threshold *2 ); }while (nr_regions > c->attrs.max_nr_regions && threshold /2 < max_thres);
[Severity: High]
This is a pre-existing issue, but can this do-while loop lock up the kdamond kernel thread indefinitely?
The loop expects to terminate when threshold / 2 >= max_thres. However, threshold is a 32-bit unsigned int that overflows when doubled.
If max_thres is derived to be a very large value during the assignment at the start of kdamond_merge_regions() (e.g., if a user configures a large aggregation and sample interval ratio), threshold could repeatedly double until it exceeds 0x7FFFFFFF.
When it overflows, max(1, threshold * 2) resets the threshold to 1. As a result, threshold / 2 would max out at 0x40000000, causing the condition threshold / 2 < max_thres to remain permanently true.
Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1
Re: [PATCH 6.12.y] mm/damon/core: skip aging from repeated aggressive merging
In reply to SJ ParkQuoted 3 lines
The number of DAMON regions could temporarily exceed the user-defined maximum number of regions limit for corner cases. For example, users could lower the limit via runtime parameters update.
Queued for 6.12, thanks.
Signature · 2 lines
Thanks, Sasha