Re: [RFC PATCH 6.6.y 3/3] mm/damon/core: remove unreachable damos charge_{target,addr}_from

[SJ Park <sj@kernel.org>]

On Sat, 07 Nov 2026 22:34:54 +0000 sashiko-bot@kernel.org wrote:

> Thank you for your contribution! Sashiko AI review found 1 potential
> issue to consider:
> - [Medium] mm/damon/core: dangling pointer ABA match in
>   damos_fix_stale_charge_pointers()
> --
> 
> commit f7e621ee98abae5b2fb7828ae72ea3e96d1173fd
> Author: SJ Park <sj@kernel.org>
> 
> mm/damon/core: remove unreachable damos charge_{target,addr}_from
> 
> This commit adds damos_fix_stale_charge_pointers() to damos_adjust_quota() to
> reset quota->charge_target_from and quota->charge_addr_from when the target is
> no longer in the context or has no regions.
> 
> Link: https://lore.kernel.org/20261020023958.108276-1-sj@kernel.org
> 
> > diff --git a/mm/damon/core.c b/mm/damon/core.c
> > index 99e934a6d1ce9..61d45d40fc1d3 100644
> > --- a/mm/damon/core.c
> > +++ b/mm/damon/core.c
> > @@ -1088,6 +1088,27 @@ static void damos_set_effective_quota(struct damos_quota *quota)
> >  	quota->esz = esz;
> >  }
> >  
> > +
> > +static void damos_fix_stale_charge_pointers(struct damon_ctx *c,
> > +		struct damos *s)
> > +{
> > +	struct damos_quota *quota;
> > +	struct damon_target *t;
> > +
> > +	quota = &s->quota;
> > +	if (!quota->charge_target_from)
> > +		return;
> > +	damon_for_each_target(t, c) {
> > +		if (t == quota->charge_target_from) {
> > +			if (damon_nr_regions(t) > 0)
> > +				return;
> > +			break;
> > +		}
> > +	}
> > +	quota->charge_target_from = NULL;
> > +	quota->charge_addr_from = 0;
> > +}
> 
> [Severity: Medium]
> Can t == quota->charge_target_from falsely match a newly allocated
> damon_target if the old one was freed and its slab slot reused before
> damos_adjust_quota() runs?
> 
> When an online commit removes a target in damon_sysfs_apply_inputs(),
> damon_sysfs_set_targets() frees the damon_target via damon_destroy_target(),
> leaving quota->charge_target_from dangling, while damon_set_attrs() advances
> s->next_apply_sis past ctx->passed_sample_intervals so kdamond_apply_schemes()
> skips damos_adjust_quota() on that cycle.  If another target is added before
> damos_adjust_quota() next runs, kmalloc() can allocate the new damon_target at
> the same address, causing damos_fix_stale_charge_pointers() to return early
> and leave the stale charge_target_from and charge_addr_from values active in
> damos_skip_charged_region().  Clearing charge_target_from and charge_addr_from
> when the target is destroyed during commit would avoid keeping a dangling
> pointer.

Good finding, but no real issue.  Occasionally starting quota charging from
unexpected target is no real issue in real DAMOS use case in my opinion.  Also,
same behavior in the mainline.  No blocker for this patch.

> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20261107222202.331476-1-sj@kernel.org?part=3
> 


Thanks,
SJ