Re: [PATCH 6.1.y] mm/damon/vaddr: drop last same folio access check optimization

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The PMD is read directly via `*pmd` outside a lock, which can cause torn reads on architectures where PMD size is larger than the word size (e.g., 32-bit PAE).
--

commit 3ab3595f2bebbbf09add4e61c160f37ee6aa2807
Author: SJ Park <sj@kernel.org>

mm/damon/vaddr: drop last same folio access check optimization

This commit removes the same-folio access check optimization from DAMON's
virtual address monitoring. The optimization was found to race when multiple
kdamonds are running, and its impact was deemed doubtful.

Link: https://lore.kernel.org/20260715031002.108504-4-sj@kernel.org
Link: https://lore.kernel.org/20260621204050.10993-1-sj@kernel.org [1]

> diff --git a/mm/damon/vaddr.c b/mm/damon/vaddr.c
> index 708f281c1b6b4..4aa89347d754d 100644
> --- a/mm/damon/vaddr.c
> +++ b/mm/damon/vaddr.c
[ ... ]
> @@ -453,10 +452,8 @@ static int damon_young_pmd_entry(pmd_t *pmd, unsigned long addr,
>  			goto huge_out;
>  		if (pmd_young(*pmd) || !page_is_idle(page) ||
>  					mmu_notifier_test_young(walk->mm,
> -						addr)) {
> -			*priv->page_sz = HPAGE_PMD_SIZE;
> +						addr))
>  			priv->young = true;

[Severity: High]
This is a pre-existing issue, but does reading the PMD directly via *pmd
outside a lock risk torn reads on architectures where the PMD size is larger
than the word size (like 32-bit PAE)?

Earlier in damon_young_pmd_entry(), the code does:

if (pmd_trans_huge(*pmd)) {
        ptl = pmd_lock(walk->mm, pmd);

Since damon_young_pmd_entry() runs during DAMON's page table walk under
mmap_read_lock(), concurrent THP modifications aren't prevented. If a torn
read occurs on the lockless *pmd evaluation during a concurrent THP split or
collapse, it could bypass both the pmd_trans_huge() and pmd_bad() checks.

If it falls through to the regular page path, pte_offset_map_lock() might
map a bogus physical address from the torn value, allowing arbitrary memory
to be treated as PTEs.

A similar lockless check appears to exist in damon_mkold_pmd_entry() as
well. Could these paths use pmd_read_atomic() or pmdp_get_lockless() to
safely evaluate the PMD?

> -		}
>  		put_page(page);
>  huge_out:
>  		spin_unlock(ptl);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260909061152.278678-1-sj@kernel.org?part=1