FAILED: patch "[PATCH] mm/damon/sysfs: read ops_id only once in" failed to apply to 6.18-stable tree

PATCH In review [email protected] 5 participants 7 messages Sep 8 – Sep 11

Subsystems (3)

Stable branch Memory management DAMON

lore

Share & tools

lore

[email protected]

author maintainer

2026-09-08 12:56 UTC #0 lore raw

The patch below does not apply to the 6.18-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.18.y
git checkout FETCH_HEAD
git cherry-pick -x 5adaaa28be8a79ddd7e103b171f9d6e14e7fc26e
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026090858-arousal-getting-ee35@gregkh' --subject-prefix 'PATCH 6.18.y' 'HEAD^..'

Possible dependencies:

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 5adaaa28be8a79ddd7e103b171f9d6e14e7fc26e Mon Sep 17 00:00:00 2001
From: SJ Park <[email protected]>
Date: Tue, 14 Jul 2026 20:10:01 -0700
Subject: [PATCH] mm/damon/sysfs: read ops_id only once in
damon_sysfs_apply_inputs()

damon_sysfs_apply_inputs() reads ops_id twice. It could race with ops_id_store(). As a result, the min_region_sz could wrongly be set up. Read it once.

The user impact is trivial. Sane users ain't update the parameter in parallel. Even if it happens, the DAMON core layer handles the wrong min_region_sz (!is_power_of_2()). Even if somehow the race ended up making a min_region_sz that is different from the user's intention but still valid, only monitoring itself runs differently than expected. No critical consequences like kernel panic or memory corruption happen

The issue was discovered [1] by Sashiko.

Link https://lore.kernel.org/[email protected] open here

Link https://lore.kernel.org/[email protected] [1] open here

Fixes 8d009da32f13 ("mm/damon/sysfs: set damon_ctx->min_sz_region only for paddr use case")

Signed-off-by SJ Park <[email protected]>

Cc <[email protected]> # 6.18.x

Signed-off-by Andrew Morton <[email protected]>

mm/damon/sysfs.c +4 -2

index 3db4da88fc72..e3858ffab4b2 100644
@@ -2094,14 +2094,16 @@ static inline bool damon_sysfs_kdamond_running(
 static int damon_sysfs_apply_inputs(struct damon_ctx *ctx,
 		struct damon_sysfs_context *sys_ctx)
 {
+	enum damon_ops_id ops_id;
 	int err;
 
-	err = damon_select_ops(ctx, sys_ctx->ops_id);
+	ops_id = READ_ONCE(sys_ctx->ops_id);
+	err = damon_select_ops(ctx, ops_id);
 	if (err)
 		return err;
 	ctx->addr_unit = READ_ONCE(sys_ctx->addr_unit);
 	/* addr_unit is respected by only DAMON_OPS_PADDR */
-	if (sys_ctx->ops_id == DAMON_OPS_PADDR)
+	if (ops_id == DAMON_OPS_PADDR)
 		ctx->min_region_sz = max(
 				DAMON_MIN_REGION_SZ / ctx->addr_unit, 1);
 	ctx->pause = sys_ctx->pause;

SJ Park

maintainer

2026-09-09 03:28 UTC #1 lore raw

PATCH 1/1 mm/damon/sysfs: read ops_id only once in damon_sysfs_apply_inputs()

damon_sysfs_apply_inputs() reads ops_id twice. It could race with ops_id_store(). As a result, the min_region_sz could wrongly be set up. Read it once.

The issue was discovered [1] by Sashiko.

Link https://lore.kernel.org/[email protected] open here

Link https://lore.kernel.org/[email protected] [1] open here

Fixes 8d009da32f13 ("mm/damon/sysfs: set damon_ctx->min_sz_region only for paddr use case")

Signed-off-by SJ Park <[email protected]>

Cc <[email protected]> # 6.18.x

Signed-off-by Andrew Morton <[email protected]>

(cherry picked from commit 5adaaa28be8a79ddd7e103b171f9d6e14e7fc26e)

Signed-off-by SJ Park <[email protected]>

---
 mm/damon/sysfs.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

mm/damon/sysfs.c +4 -2

index a6c3e83a3dad5..655e4de69bee8 100644
@@ -1432,14 +1432,16 @@ static inline bool damon_sysfs_kdamond_running(
 static int damon_sysfs_apply_inputs(struct damon_ctx *ctx,
 		struct damon_sysfs_context *sys_ctx)
 {
+	enum damon_ops_id ops_id;
 	int err;
 
-	err = damon_select_ops(ctx, sys_ctx->ops_id);
+	ops_id = READ_ONCE(sys_ctx->ops_id);
+	err = damon_select_ops(ctx, ops_id);
 	if (err)
 		return err;
 	ctx->addr_unit = sys_ctx->addr_unit;
 	/* addr_unit is respected by only DAMON_OPS_PADDR */
-	if (sys_ctx->ops_id == DAMON_OPS_PADDR)
+	if (ops_id == DAMON_OPS_PADDR)
 		ctx->min_sz_region = max(
 				DAMON_MIN_REGION / sys_ctx->addr_unit, 1);
 	err = damon_sysfs_set_attrs(ctx, sys_ctx->attrs);

Signature · 1 line

2.47.3

[email protected]

AI review

2026-09-09 03:45 UTC #2 lore raw

Re: [PATCH 6.18.y] mm/damon/sysfs: read ops_id only once in damon_sysfs_apply_inputs()

Sashiko has reviewed this patch and found no issues. It looks great!

Quoted 13 lines

damon_sysfs_apply_inputs() reads ops_id twice. It could race with ops_id_store(). As a result, the min_region_sz could wrongly be set up. Read it once.
The user impact is trivial. Sane users ain't update the parameter in parallel. Even if it happens, the DAMON core layer handles the wrong min_region_sz (!is_power_of_2()). Even if somehow the race ended up making a min_region_sz that is different from the user's intention but still valid, only monitoring itself runs differently than expected. No critical consequences like kernel panic or memory corruption happen
The issue was discovered [1] by Sashiko.

Quoted 8 lines

Link https://lore.kernel.org/[email protected] open here
Link https://lore.kernel.org/[email protected] [1] open here
Fixes 8d009da32f13 ("mm/damon/sysfs: set damon_ctx->min_sz_region only for paddr use case")
Signed-off-by SJ Park <[email protected]>
Cc <[email protected]> # 6.18.x
Signed-off-by Andrew Morton <[email protected]>
(cherry picked from commit 5adaaa28be8a79ddd7e103b171f9d6e14e7fc26e)
Signed-off-by SJ Park <[email protected]>

Sashiko has reviewed this patch and found no issues. It looks great!

Signature · 1 line

Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1

Greg KH

2026-09-09 13:04 UTC #3 lore raw

Re: [PATCH 6.18.y] mm/damon/sysfs: read ops_id only once in damon_sysfs_apply_inputs()

In reply to SJ Park

Quoted 52 lines · SJ Park

damon_sysfs_apply_inputs() reads ops_id twice. It could race with ops_id_store(). As a result, the min_region_sz could wrongly be set up. Read it once.
The user impact is trivial. Sane users ain't update the parameter in parallel. Even if it happens, the DAMON core layer handles the wrong min_region_sz (!is_power_of_2()). Even if somehow the race ended up making a min_region_sz that is different from the user's intention but still valid, only monitoring itself runs differently than expected. No critical consequences like kernel panic or memory corruption happen
The issue was discovered [1] by Sashiko.
Link https://lore.kernel.org/[email protected] open here
Link https://lore.kernel.org/[email protected] [1] open here
Fixes 8d009da32f13 ("mm/damon/sysfs: set damon_ctx->min_sz_region only for paddr use case")
Signed-off-by SJ Park <[email protected]>
Cc <[email protected]> # 6.18.x
Signed-off-by Andrew Morton <[email protected]>
(cherry picked from commit 5adaaa28be8a79ddd7e103b171f9d6e14e7fc26e)
Signed-off-by SJ Park <[email protected]>
---
 mm/damon/sysfs.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)
mm/damon/sysfs.c +4 -2
index a6c3e83a3dad5..655e4de69bee8 100644
@@ -1432,14 +1432,16 @@ static inline bool damon_sysfs_kdamond_running(
 static int damon_sysfs_apply_inputs(struct damon_ctx *ctx,
 		struct damon_sysfs_context *sys_ctx)
 {
+	enum damon_ops_id ops_id;
 	int err;
 
-	err = damon_select_ops(ctx, sys_ctx->ops_id);
+	ops_id = READ_ONCE(sys_ctx->ops_id);
+	err = damon_select_ops(ctx, ops_id);
 	if (err)
 		return err;
 	ctx->addr_unit = sys_ctx->addr_unit;
 	/* addr_unit is respected by only DAMON_OPS_PADDR */
-	if (sys_ctx->ops_id == DAMON_OPS_PADDR)
+	if (ops_id == DAMON_OPS_PADDR)
 		ctx->min_sz_region = max(
 				DAMON_MIN_REGION / sys_ctx->addr_unit, 1);
 	err = damon_sysfs_set_attrs(ctx, sys_ctx->attrs);
Signature · 1 line
2.47.3

Does not apply :(

SJ Park

maintainer

2026-09-10 00:45 UTC #4 lore raw

Re: [PATCH 6.18.y] mm/damon/sysfs: read ops_id only once in damon_sysfs_apply_inputs()

Quoted 47 lines · On Wed, 9 Sep 2026 15:01:49 +0200 Greg KH <[email protected]> wrote:

Quoted 46 lines · SJ Park
damon_sysfs_apply_inputs() reads ops_id twice. It could race with ops_id_store(). As a result, the min_region_sz could wrongly be set up. Read it once.
The user impact is trivial. Sane users ain't update the parameter in parallel. Even if it happens, the DAMON core layer handles the wrong min_region_sz (!is_power_of_2()). Even if somehow the race ended up making a min_region_sz that is different from the user's intention but still valid, only monitoring itself runs differently than expected. No critical consequences like kernel panic or memory corruption happen
The issue was discovered [1] by Sashiko.
Link https://lore.kernel.org/[email protected] open here
Link https://lore.kernel.org/[email protected] [1] open here
Fixes 8d009da32f13 ("mm/damon/sysfs: set damon_ctx->min_sz_region only for paddr use case")
Signed-off-by SJ Park <[email protected]>
Cc <[email protected]> # 6.18.x
Signed-off-by Andrew Morton <[email protected]>
(cherry picked from commit 5adaaa28be8a79ddd7e103b171f9d6e14e7fc26e)
Signed-off-by SJ Park <[email protected]>
---
 mm/damon/sysfs.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)
mm/damon/sysfs.c +4 -2
index a6c3e83a3dad5..655e4de69bee8 100644
@@ -1432,14 +1432,16 @@ static inline bool damon_sysfs_kdamond_running(
 static int damon_sysfs_apply_inputs(struct damon_ctx *ctx,
 		struct damon_sysfs_context *sys_ctx)
 {
+	enum damon_ops_id ops_id;
 	int err;
 
-	err = damon_select_ops(ctx, sys_ctx->ops_id);
+	ops_id = READ_ONCE(sys_ctx->ops_id);
+	err = damon_select_ops(ctx, ops_id);
 	if (err)
 		return err;
 	ctx->addr_unit = sys_ctx->addr_unit;
 	/* addr_unit is respected by only DAMON_OPS_PADDR */
-	if (sys_ctx->ops_id == DAMON_OPS_PADDR)
+	if (ops_id == DAMON_OPS_PADDR)
 		ctx->min_sz_region = max(

Quoted 8 lines

Quoted 6 lines
mm/damon/sysfs.c +0 -0
 				DAMON_MIN_REGION / sys_ctx->addr_unit, 1);
 	err = damon_sysfs_set_attrs(ctx, sys_ctx->attrs);
Signature · 1 line
2.47.3
Does not apply :(

Seems a patch in 6.18.50..6.18.51-rc1 is causing the conflict. I just rebased the patch on 6.18.51-rc1 and posted as another reply [1].

[1] https://lore.kernel.org/[email protected]

Thanks,
SJ

[...]

SJ Park

maintainer

2026-09-10 00:42 UTC #5 lore raw

PATCH 1/1 mm/damon/sysfs: read ops_id only once in damon_sysfs_apply_inputs()

In reply to [email protected]

damon_sysfs_apply_inputs() reads ops_id twice. It could race with ops_id_store(). As a result, the min_region_sz could wrongly be set up. Read it once.

The issue was discovered [1] by Sashiko.

Link https://lore.kernel.org/[email protected] open here

Link https://lore.kernel.org/[email protected] [1] open here

Fixes 8d009da32f13 ("mm/damon/sysfs: set damon_ctx->min_sz_region only for paddr use case")

Signed-off-by SJ Park <[email protected]>

Cc <[email protected]> # 6.18.x

Signed-off-by Andrew Morton <[email protected]>

(cherry picked from commit 5adaaa28be8a79ddd7e103b171f9d6e14e7fc26e)

Signed-off-by SJ Park <[email protected]>

---
 mm/damon/sysfs.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

mm/damon/sysfs.c +4 -2

index 53f99f05eb38e..7f52470be36e3 100644
@@ -1440,14 +1440,16 @@ static inline bool damon_sysfs_kdamond_running(
 static int damon_sysfs_apply_inputs(struct damon_ctx *ctx,
 		struct damon_sysfs_context *sys_ctx)
 {
+	enum damon_ops_id ops_id;
 	int err;
 
-	err = damon_select_ops(ctx, sys_ctx->ops_id);
+	ops_id = READ_ONCE(sys_ctx->ops_id);
+	err = damon_select_ops(ctx, ops_id);
 	if (err)
 		return err;
 	ctx->addr_unit = READ_ONCE(sys_ctx->addr_unit);
 	/* addr_unit is respected by only DAMON_OPS_PADDR */
-	if (sys_ctx->ops_id == DAMON_OPS_PADDR)
+	if (ops_id == DAMON_OPS_PADDR)
 		ctx->min_sz_region = max(
 				DAMON_MIN_REGION / ctx->addr_unit, 1);
 	err = damon_sysfs_set_attrs(ctx, sys_ctx->attrs);

Signature · 1 line

2.47.3

Sasha Levin

maintainer Applied

2026-09-11 11:21 UTC #6 lore raw

Re: [PATCH 6.18.y] mm/damon/sysfs: read ops_id only once in damon_sysfs_apply_inputs()

Quoted 3 lines

damon_sysfs_apply_inputs() reads ops_id twice. It could race with ops_id_store(). As a result, the min_region_sz could wrongly be set up.

Queued for 6.18, thanks.

Signature · 2 lines

Thanks,
Sasha