[RFC PATCH 6.1.y 0/2] mm/damon: porting fixes that cherry-pick failed on 2026-11-07

[RFC PATCH 6.1.y 0/2] mm/damon: porting fixes that cherry-pick failed on 2026-11-07

[SJ Park]

Manually port two DAMON fixes that cherry-pick failed [1,2] and turned
out to really need to be picked.  Note that seven patches [3-9] that
also failed in the same day were having wrong Cc:stable@ tags, so
ignored.

Patches that this series is porting.

[1] https://lore.kernel.org/20261107054458-failed-6.1-90c2fa6adfed@kernel.org
[2] https://lore.kernel.org/20261107055454-failed-6.1-5695abc4e742@kernel.org

Patches that also cherry-pick failed but deliverately ignored.

[3] https://lore.kernel.org/20261107054658-failed-6.1-cec08aad3def@kernel.org
[4] https://lore.kernel.org/20261107054701-failed-6.1-1bfb9384ae0e@kernel.org
[5] https://lore.kernel.org/20261107054705-failed-6.1-6f276422aded@kernel.org
[6] https://lore.kernel.org/20261107054708-failed-6.1-a1c7fdaf1657@kernel.org
[7] https://lore.kernel.org/20261107054711-failed-6.1-409d2ab6d982@kernel.org
[8] https://lore.kernel.org/20261107054714-failed-6.1-1d2397b2c414@kernel.org
[9] https://lore.kernel.org/20261107054721-failed-6.1-1c3352282063@kernel.org

SJ Park (2):
  mm/damon/core: skip applying scheme if region split for quota fails
  mm/damon/core: remove unreachable damos charge_{target,addr}_from

 mm/damon/core.c | 34 ++++++++++++++++++++++++++++++----
 1 file changed, 30 insertions(+), 4 deletions(-)


base-commit: 807b0a2cf04f7d9b6d42d23f5e63915fb80a54fd
-- 
2.47.3

[RFC PATCH 6.1.y 1/2] mm/damon/core: skip applying scheme if region split for quota fails

[SJ Park]

Patch series "mm/damon: fix DAMOS bugs in core, paddr and vaddr".

Fix misc bugs of DAMOS.  Patch 1 makes DAMOS less stress memory allocator
under extreme situation.  Patches 2 and 3 fix wrong folios walking in
DAMON_PADDR.  Patches 4 and 5 fix wrong folios walking in DAMON_VADDR.
Patches 6-8 handle extreme and unlikely memory situations that can cause
divide by zero and underflow.

All bugs are discovered by Sashiko.

This patch (of 8):

damos_apply_scheme() splits a region and apply the action to the subregion
if it is needed for not violating the quota.  The split operation
(damon_split_region_at()) could fail for allocation failure.  In the case,
the quota could be violated.  From the user's perspective, DAMOS becomes
more aggressive than expected under the extreme situation.  Handle the
failure.

The user impact is not critical.  The failure of damon_split_region_at()
is unlikely since it is arguably too small to fail.  Also DAMOS being
aggressive is limited to the single region.  Users can set min_nr_regions
to set the maximum size of each region.  If it is reasonably set, the
transient overhead shouldn't be critical.

The issue was discovered [1] by Sashiko.

6.1.y porting notes.  Modify damon_split_region_at() to return failures.
It is a part of commit c60874860762 ("mm/damon/core: handle region split
failure in apply_min_nr_regions()").  Without it, build fails.

Link: https://lore.kernel.org/20260901131850.98037-1-sj@kernel.org
Link: https://lore.kernel.org/20260901131850.98037-2-sj@kernel.org
Link: https://lore.kernel.org/20260718171523.87547-1-sj@kernel.org [1]
Fixes: 2b8a248d5873 ("mm/damon/schemes: implement size quota for schemes application speed control")
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Usama Arif <usamaarif642@gmail.com>
Cc: <stable@vger.kernel.org> # 5.16.x
(cherry picked from commit 90c2fa6adfed7abe0935506a43cdff3a05c1fff0)
Signed-off-by: SJ Park <sj@kernel.org>
---
 mm/damon/core.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/mm/damon/core.c b/mm/damon/core.c
index f0da5cb2b88a0..9206737d05ae7 100644
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -718,7 +718,7 @@ static void kdamond_reset_aggregated(struct damon_ctx *c)
 	}
 }
 
-static void damon_split_region_at(struct damon_target *t,
+static int damon_split_region_at(struct damon_target *t,
 				  struct damon_region *r, unsigned long sz_r);
 
 static bool __damos_valid_target(struct damon_region *r, struct damos *s)
@@ -810,7 +810,8 @@ static void damon_do_apply_schemes(struct damon_ctx *c,
 						DAMON_MIN_REGION);
 				if (!sz)
 					goto update_stat;
-				damon_split_region_at(t, r, sz);
+				if (damon_split_region_at(t, r, sz))
+					goto update_stat;
 			}
 			ktime_get_coarse_ts64(&begin);
 			sz_applied = c->ops.apply_scheme(c, t, r, s);
@@ -1015,15 +1016,17 @@ static void kdamond_merge_regions(struct damon_ctx *c, unsigned int threshold,
  *
  * r		the region to be split
  * sz_r		size of the first sub-region that will be made
+ *
+ * Return: 0 on success, negative error code otherwise.
  */
-static void damon_split_region_at(struct damon_target *t,
+static int damon_split_region_at(struct damon_target *t,
 				  struct damon_region *r, unsigned long sz_r)
 {
 	struct damon_region *new;
 
 	new = damon_new_region(r->ar.start + sz_r, r->ar.end);
 	if (!new)
-		return;
+		return -ENOMEM;
 
 	r->ar.end = new->ar.start;
 
@@ -1031,6 +1034,7 @@ static void damon_split_region_at(struct damon_target *t,
 	new->last_nr_accesses = r->last_nr_accesses;
 
 	damon_insert_region(new, r, damon_next_region(r), t);
+	return 0;
 }
 
 /* Split every region in the given target into 'nr_subs' regions */
-- 
2.47.3

[RFC PATCH 6.1.y 2/2] mm/damon/core: remove unreachable damos charge_{target,addr}_from

[SJ Park]

damos_quota->charge_{target,addr}_from saves the target and region the
scheme's quota limit is reached.  damos_skip_charged_region() skips the
target and regions before the point.  The target that was assigned to
charge_target_from could be dynamically removed from the context by the
runtime parameters update (aka commit) feature.  In this case,
damos_skip_charged_region() cannot find if the point is passed or not,
so the scheme is effectively disabled.

Similarly, the user could also remove all the regions of the target
using the runtime parameters update feature.  It would be uncommon to do
that, but it is a supported feature.  Because the skip pointer detection
logic (damos_skip_charged_region()) works for each region of targets,
this result in the logic is entirely skipped and the scheme is
effectively disabled again.

The user impact is that the DAMOS scheme could suddenly stop working
under certain uses of the runtime parameters update feature.  It could
surprise users. No crash or leak happens though.  Users could also
simply work around by re-installing the scheme.

Catch the corner cases in damos_adjust_quota() and reset the pointers.

Link: https://lore.kernel.org/20261020023958.108276-1-sj@kernel.org
Fixes: da87878010e5 ("mm/damon/sysfs: support online inputs update")
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Closes: https://sashiko.dev/#/bug/linux-cd0c55fc-0cc8-45d8-9637-3334811c49b8
Cc: <stable@vger.kernel.org> # 5.19.x
(cherry picked from commit 5695abc4e742b947f586bfb6a080a80ad9957e5d)
Signed-off-by: SJ Park <sj@kernel.org>
---
 mm/damon/core.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/mm/damon/core.c b/mm/damon/core.c
index 9206737d05ae7..01f93146b92fe 100644
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -860,6 +860,26 @@ static void damos_set_effective_quota(struct damos_quota *quota)
 	quota->esz = esz;
 }
 
+static void damos_fix_stale_charge_pointers(struct damon_ctx *c,
+		struct damos *s)
+{
+	struct damos_quota *quota;
+	struct damon_target *t;
+
+	quota = &s->quota;
+	if (!quota->charge_target_from)
+		return;
+	damon_for_each_target(t, c) {
+		if (t == quota->charge_target_from) {
+			if (damon_nr_regions(t) > 0)
+				return;
+			break;
+		}
+	}
+	quota->charge_target_from = NULL;
+	quota->charge_addr_from = 0;
+}
+
 static void kdamond_apply_schemes(struct damon_ctx *c)
 {
 	struct damon_target *t;
@@ -890,6 +910,8 @@ static void kdamond_apply_schemes(struct damon_ctx *c)
 			damos_set_effective_quota(quota);
 		}
 
+		damos_fix_stale_charge_pointers(c, s);
+
 		if (!c->ops.get_scheme_score)
 			continue;
 
-- 
2.47.3

Re: [RFC PATCH 6.1.y 1/2] mm/damon/core: skip applying scheme if region split for quota fails

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] mm/damon: inflated tried stats in damon_do_apply_schemes() on
  split failure
--

commit 2d405ecddea503227b3b4138fe63cbeb95dc50b9
Author: SJ Park <sj@kernel.org>

mm/damon/core: skip applying scheme if region split for quota fails

This commit changes damon_split_region_at() to return an error on memory
allocation failure and skips applying the DAMOS scheme in
damon_do_apply_schemes() when splitting a region to fit within the size
quota fails.

Link: https://lore.kernel.org/20260901131850.98037-1-sj@kernel.org
Link: https://lore.kernel.org/20260901131850.98037-2-sj@kernel.org
Link: https://lore.kernel.org/20260718171523.87547-1-sj@kernel.org [1]

> diff --git a/mm/damon/core.c b/mm/damon/core.c
> index f0da5cb2b88a0..9206737d05ae7 100644
> --- a/mm/damon/core.c
> +++ b/mm/damon/core.c

[ ... ]

> @@ -810,7 +810,8 @@ static void damon_do_apply_schemes(struct damon_ctx *c,
>  						DAMON_MIN_REGION);
>  				if (!sz)
>  					goto update_stat;
> -				damon_split_region_at(t, r, sz);
> +				if (damon_split_region_at(t, r, sz))
> +					goto update_stat;

[Severity: Low]
Does jumping to update_stat here inflate s->stat.nr_tried and
s->stat.sz_tried when damon_split_region_at() fails?

Unlike the !sz path right above, sz holds the non-zero remaining quota
when damon_split_region_at() is called, and update_stat unconditionally
accounts it:

mm/damon/core.c:damon_do_apply_schemes() {
	...
update_stat:
		s->stat.nr_tried++;
		s->stat.sz_tried += sz;
	...
}

Because c->ops.apply_scheme() is skipped and quota->charged_sz is not
advanced, any subsequent matching regions in the same pass that also fail
to split will repeatedly add sz to s->stat.sz_tried.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261107224800.340250-1-sj@kernel.org?part=1

Re: [RFC PATCH 6.1.y 1/2] mm/damon/core: skip applying scheme if region split for quota fails

[SJ Park]

On Sat, 07 Nov 2026 22:56:53 +0000 sashiko-bot@kernel.org wrote:

> Thank you for your contribution! Sashiko AI review found 1 potential
> issue to consider:
> - [Low] mm/damon: inflated tried stats in damon_do_apply_schemes() on
>   split failure
> --
> 
> commit 2d405ecddea503227b3b4138fe63cbeb95dc50b9
> Author: SJ Park <sj@kernel.org>
> 
> mm/damon/core: skip applying scheme if region split for quota fails
> 
> This commit changes damon_split_region_at() to return an error on memory
> allocation failure and skips applying the DAMOS scheme in
> damon_do_apply_schemes() when splitting a region to fit within the size
> quota fails.
> 
> Link: https://lore.kernel.org/20260901131850.98037-1-sj@kernel.org
> Link: https://lore.kernel.org/20260901131850.98037-2-sj@kernel.org
> Link: https://lore.kernel.org/20260718171523.87547-1-sj@kernel.org [1]
> 
> > diff --git a/mm/damon/core.c b/mm/damon/core.c
> > index f0da5cb2b88a0..9206737d05ae7 100644
> > --- a/mm/damon/core.c
> > +++ b/mm/damon/core.c
> 
> [ ... ]
> 
> > @@ -810,7 +810,8 @@ static void damon_do_apply_schemes(struct damon_ctx *c,
> >  						DAMON_MIN_REGION);
> >  				if (!sz)
> >  					goto update_stat;
> > -				damon_split_region_at(t, r, sz);
> > +				if (damon_split_region_at(t, r, sz))
> > +					goto update_stat;
> 
> [Severity: Low]
> Does jumping to update_stat here inflate s->stat.nr_tried and
> s->stat.sz_tried when damon_split_region_at() fails?
> 
> Unlike the !sz path right above, sz holds the non-zero remaining quota
> when damon_split_region_at() is called, and update_stat unconditionally
> accounts it:
> 
> mm/damon/core.c:damon_do_apply_schemes() {
> 	...
> update_stat:
> 		s->stat.nr_tried++;
> 		s->stat.sz_tried += sz;
> 	...
> }
> 
> Because c->ops.apply_scheme() is skipped and quota->charged_sz is not
> advanced, any subsequent matching regions in the same pass that also fail
> to split will repeatedly add sz to s->stat.sz_tried.

Good finding, but the user impact is trivial.  Same behavior exists in the
mainline, too.  Hence no blocker for this patch.

> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20261107224800.340250-1-sj@kernel.org?part=1
> 


Thanks,
SJ

Re: [RFC PATCH 6.1.y 2/2] mm/damon/core: remove unreachable damos charge_{target,addr}_from

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] mm/damon/core: stale charge_target_from ABA reuse when scheme
  is inactive
--

commit 853b3e89da132f2ce03750bcf6dfc1f62a70d261
Author: SJ Park <sj@kernel.org>

mm/damon/core: remove unreachable damos charge_{target,addr}_from

This commit adds damos_fix_stale_charge_pointers() to clear
quota->charge_target_from and quota->charge_addr_from when the referenced
target has been removed or no longer has any regions.

Link: https://lore.kernel.org/20261020023958.108276-1-sj@kernel.org

> diff --git a/mm/damon/core.c b/mm/damon/core.c
> index 9206737d05ae7..01f93146b92fe 100644
> --- a/mm/damon/core.c
> +++ b/mm/damon/core.c
> @@ -860,6 +860,26 @@ static void damos_set_effective_quota(struct damos_quota *quota)
>  	quota->esz = esz;
>  }
>  
> +static void damos_fix_stale_charge_pointers(struct damon_ctx *c,
> +		struct damos *s)
> +{
> +	struct damos_quota *quota;
> +	struct damon_target *t;
> +
> +	quota = &s->quota;
> +	if (!quota->charge_target_from)
> +		return;
> +	damon_for_each_target(t, c) {
> +		if (t == quota->charge_target_from) {
> +			if (damon_nr_regions(t) > 0)
> +				return;
> +			break;
> +		}
> +	}
> +	quota->charge_target_from = NULL;
> +	quota->charge_addr_from = 0;
> +}
> +
>  static void kdamond_apply_schemes(struct damon_ctx *c)
>  {
>  	struct damon_target *t;
> @@ -890,6 +910,8 @@ static void kdamond_apply_schemes(struct damon_ctx *c)
>  			damos_set_effective_quota(quota);
>  		}
>  
> +		damos_fix_stale_charge_pointers(c, s);
> +
>  		if (!c->ops.get_scheme_score)
>  			continue;
>  

[Severity: Medium]
Can quota->charge_target_from match a newly allocated target due to slab
address reuse if the old target was freed while the scheme was inactive?

kdamond_apply_schemes() skips inactive schemes at the !s->wmarks.activated
check before reaching damos_fix_stale_charge_pointers(), and
damon_sysfs_set_targets() frees removed targets via damon_destroy_target()
without clearing charge_target_from.  If an online commit removes the
target stored in charge_target_from while the scheme is deactivated by
watermarks and a later commit allocates a new target at the same address,
damos_fix_stale_charge_pointers() will see t == quota->charge_target_from
with regions present and leave the stale charge_target_from and
charge_addr_from in place.  When the scheme reactivates,
damon_do_apply_schemes() will skip targets before the new target and
regions up to the old charge_addr_from.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261107224800.340250-1-sj@kernel.org?part=2

Re: [RFC PATCH 6.1.y 2/2] mm/damon/core: remove unreachable damos charge_{target,addr}_from

[SJ Park]

On Sat, 07 Nov 2026 23:02:33 +0000 sashiko-bot@kernel.org wrote:

> Thank you for your contribution! Sashiko AI review found 1 potential
> issue to consider:
> - [Medium] mm/damon/core: stale charge_target_from ABA reuse when scheme
>   is inactive
> --
> 
> commit 853b3e89da132f2ce03750bcf6dfc1f62a70d261
> Author: SJ Park <sj@kernel.org>
> 
> mm/damon/core: remove unreachable damos charge_{target,addr}_from
> 
> This commit adds damos_fix_stale_charge_pointers() to clear
> quota->charge_target_from and quota->charge_addr_from when the referenced
> target has been removed or no longer has any regions.
> 
> Link: https://lore.kernel.org/20261020023958.108276-1-sj@kernel.org
> 
> > diff --git a/mm/damon/core.c b/mm/damon/core.c
> > index 9206737d05ae7..01f93146b92fe 100644
> > --- a/mm/damon/core.c
> > +++ b/mm/damon/core.c
> > @@ -860,6 +860,26 @@ static void damos_set_effective_quota(struct damos_quota *quota)
> >  	quota->esz = esz;
> >  }
> >  
> > +static void damos_fix_stale_charge_pointers(struct damon_ctx *c,
> > +		struct damos *s)
> > +{
> > +	struct damos_quota *quota;
> > +	struct damon_target *t;
> > +
> > +	quota = &s->quota;
> > +	if (!quota->charge_target_from)
> > +		return;
> > +	damon_for_each_target(t, c) {
> > +		if (t == quota->charge_target_from) {
> > +			if (damon_nr_regions(t) > 0)
> > +				return;
> > +			break;
> > +		}
> > +	}
> > +	quota->charge_target_from = NULL;
> > +	quota->charge_addr_from = 0;
> > +}
> > +
> >  static void kdamond_apply_schemes(struct damon_ctx *c)
> >  {
> >  	struct damon_target *t;
> > @@ -890,6 +910,8 @@ static void kdamond_apply_schemes(struct damon_ctx *c)
> >  			damos_set_effective_quota(quota);
> >  		}
> >  
> > +		damos_fix_stale_charge_pointers(c, s);
> > +
> >  		if (!c->ops.get_scheme_score)
> >  			continue;
> >  
> 
> [Severity: Medium]
> Can quota->charge_target_from match a newly allocated target due to slab
> address reuse if the old target was freed while the scheme was inactive?
> 
> kdamond_apply_schemes() skips inactive schemes at the !s->wmarks.activated
> check before reaching damos_fix_stale_charge_pointers(), and
> damon_sysfs_set_targets() frees removed targets via damon_destroy_target()
> without clearing charge_target_from.  If an online commit removes the
> target stored in charge_target_from while the scheme is deactivated by
> watermarks and a later commit allocates a new target at the same address,
> damos_fix_stale_charge_pointers() will see t == quota->charge_target_from
> with regions present and leave the stale charge_target_from and
> charge_addr_from in place.  When the scheme reactivates,
> damon_do_apply_schemes() will skip targets before the new target and
> regions up to the old charge_addr_from.

Good finding but no real issue.  Occasionally starting quota charging from an
unexpected target is no real issue for DAMOS in my opinion.  So, no blocker.

> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20261107224800.340250-1-sj@kernel.org?part=2
> 


Thanks,
SJ