[PATCH 5.15.y] mm/damon/vaddr: drop last same folio access check optimization

[PATCH 5.15.y] mm/damon/vaddr: drop last same folio access check optimization

[SJ Park]

The optimization can race when multiple kdamonds are running.  Meanwhile,
the impact of the optimization is quite doubtful.  Just remove it.

The user impact of the issue should be quite trivial.  After all, the race
can happen only when the user intentionally setup DAMON in the way.  Even
if it happens, it would be rare and only degrade the best-effort
monitoring results.  No critical consequences like kernel panic or memory
corruption happen.

The race possibility was discovered [1] by Sashiko.

Link: https://lore.kernel.org/20260715031002.108504-4-sj@kernel.org
Link: https://lore.kernel.org/20260621204050.10993-1-sj@kernel.org [1]
Fixes: 3f49584b262c ("mm/damon: implement primitives for the virtual memory address spaces")
Signed-off-by: SJ Park <sj@kernel.org>
Cc: <stable@vger.kernel.org> # 5.15.x
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
(cherry picked from commit 831846078caa14b7d00b2ccca8b8fe522afe3204)
Signed-off-by: SJ Park <sj@kernel.org>
---
 mm/damon/vaddr.c | 33 ++++++---------------------------
 1 file changed, 6 insertions(+), 27 deletions(-)

diff --git a/mm/damon/vaddr.c b/mm/damon/vaddr.c
index dbb0f0fb2e598..bc0034b235d83 100644
--- a/mm/damon/vaddr.c
+++ b/mm/damon/vaddr.c
@@ -516,7 +516,6 @@ void damon_va_prepare_access_checks(struct damon_ctx *ctx)
 }
 
 struct damon_young_walk_private {
-	unsigned long *page_sz;
 	bool young;
 };
 
@@ -545,10 +544,8 @@ static int damon_young_pmd_entry(pmd_t *pmd, unsigned long addr,
 			goto huge_out;
 		if (pmd_young(*pmd) || !page_is_idle(page) ||
 					mmu_notifier_test_young(walk->mm,
-						addr)) {
-			*priv->page_sz = ((1UL) << HPAGE_PMD_SHIFT);
+						addr))
 			priv->young = true;
-		}
 		put_page(page);
 huge_out:
 		spin_unlock(ptl);
@@ -567,10 +564,8 @@ static int damon_young_pmd_entry(pmd_t *pmd, unsigned long addr,
 	if (!page)
 		goto out;
 	if (pte_young(*pte) || !page_is_idle(page) ||
-			mmu_notifier_test_young(walk->mm, addr)) {
-		*priv->page_sz = PAGE_SIZE;
+			mmu_notifier_test_young(walk->mm, addr))
 		priv->young = true;
-	}
 	put_page(page);
 out:
 	pte_unmap_unlock(pte, ptl);
@@ -581,11 +576,9 @@ static struct mm_walk_ops damon_young_ops = {
 	.pmd_entry = damon_young_pmd_entry,
 };
 
-static bool damon_va_young(struct mm_struct *mm, unsigned long addr,
-		unsigned long *page_sz)
+static bool damon_va_young(struct mm_struct *mm, unsigned long addr)
 {
 	struct damon_young_walk_private arg = {
-		.page_sz = page_sz,
 		.young = false,
 	};
 
@@ -604,25 +597,11 @@ static bool damon_va_young(struct mm_struct *mm, unsigned long addr,
 static void damon_va_check_access(struct damon_ctx *ctx,
 			       struct mm_struct *mm, struct damon_region *r)
 {
-	static struct mm_struct *last_mm;
-	static unsigned long last_addr;
-	static unsigned long last_page_sz = PAGE_SIZE;
-	static bool last_accessed;
-
-	/* If the region is in the last checked page, reuse the result */
-	if (mm == last_mm && (ALIGN_DOWN(last_addr, last_page_sz) ==
-				ALIGN_DOWN(r->sampling_addr, last_page_sz))) {
-		if (last_accessed)
-			r->nr_accesses++;
-		return;
-	}
+	bool accessed;
 
-	last_accessed = damon_va_young(mm, r->sampling_addr, &last_page_sz);
-	if (last_accessed)
+	accessed = damon_va_young(mm, r->sampling_addr);
+	if (accessed)
 		r->nr_accesses++;
-
-	last_mm = mm;
-	last_addr = r->sampling_addr;
 }
 
 unsigned int damon_va_check_accesses(struct damon_ctx *ctx)
-- 
2.47.3

Re: [PATCH 5.15.y] mm/damon/vaddr: drop last same folio access check optimization

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Lockless PMD read without pmdp_get_lockless() causes torn reads on architectures with non-atomic PMD accesses.
--

commit 9322a55f3a2ea66cbeb4b3b0525204fccdd0b8a4
Author: SJ Park <sj@kernel.org>
Subject: mm/damon/vaddr: drop last same folio access check optimization

This commit drops an optimization in DAMON's virtual memory access check
that reused results if the region fell within the last checked page. The
optimization was removed because it could race when multiple kdamonds are
running and its actual impact was questionable.

Link: https://lore.kernel.org/20260715031002.108504-4-sj@kernel.org
Link: https://lore.kernel.org/20260621204050.10993-1-sj@kernel.org [1]

> diff --git a/mm/damon/vaddr.c b/mm/damon/vaddr.c
> index dbb0f0fb2e598..bc0034b235d83 100644
> --- a/mm/damon/vaddr.c
> +++ b/mm/damon/vaddr.c
[ ... ]
> @@ -545,10 +544,8 @@ static int damon_young_pmd_entry(pmd_t *pmd, unsigned long addr,
>  			goto huge_out;
>  		if (pmd_young(*pmd) || !page_is_idle(page) ||
>  					mmu_notifier_test_young(walk->mm,

[Severity: High]
This is a pre-existing issue, but does the lockless PMD read earlier in
damon_young_pmd_entry() risk torn reads on architectures with non-atomic PMD
accesses?

In the THP check, the code performs a direct dereference:

	if (pmd_huge(*pmd)) {
		ptl = pmd_lock(walk->mm, pmd);

If a torn read occurs (e.g., on 32-bit architectures with 64-bit page table
entries like ARM LPAE or i386 PAE) while concurrent huge page operations like
THP collapse or split are happening, pmd_huge() might misidentify a huge PMD
as a regular PMD.

> -						addr)) {
> -			*priv->page_sz = ((1UL) << HPAGE_PMD_SHIFT);
> +						addr))
>  			priv->young = true;
> -		}
>  		put_page(page);
>  huge_out:
>  		spin_unlock(ptl);
> @@ -567,10 +564,8 @@ static int damon_young_pmd_entry(pmd_t *pmd, unsigned long addr,
>  	if (!page)
>  		goto out;
>  	if (pte_young(*pte) || !page_is_idle(page) ||

[Severity: High]
This is also a pre-existing issue, but does the regular page fallback path
have the same torn read vulnerability?

Just before this block, the code directly dereferences the PMD again:

	if (pmd_none(*pmd) || unlikely(pmd_bad(*pmd)))
		return -EINVAL;
	pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);

If the execution falls through to pte_offset_map_lock() due to a torn
read misidentifying a huge PMD as regular, it would attempt to map the huge
page's physical memory as a page table. Dereferencing this could trigger
memory corruption or a machine check exception on non-existent memory.

Should these accesses be using pmdp_get_lockless() to ensure atomic reads?

> -			mmu_notifier_test_young(walk->mm, addr)) {
> -		*priv->page_sz = PAGE_SIZE;
> +			mmu_notifier_test_young(walk->mm, addr))
>  		priv->young = true;
> -	}
>  	put_page(page);
>  out:

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260909060736.273661-1-sj@kernel.org?part=1

Re: [PATCH 5.15.y] mm/damon/vaddr: drop last same folio access check optimization

[Sasha Levin]

> The optimization can race when multiple kdamonds are running.  Meanwhile,
> the impact of the optimization is quite doubtful.  Just remove it.

Queued for 5.15, thanks.

-- 
Thanks,
Sasha