Re: [PATCH 5.15.y] mm/damon/ops-common: call folio_test_lru() after folio_get()

[SeongJae Park <sj@kernel.org>]

On Mon, 15 Jun 2026 15:37:31 -0400 Sasha Levin <sashal@kernel.org> wrote:

> From: SeongJae Park <sj@kernel.org>
> 
> [ Upstream commit d6b8b02a27b3dd09ec12144322b3dac46d9bc9ef ]
> 
> damon_get_folio() speculatively calls folio_test_lru() before
> folio_try_get().  The folio can get freed and reallocated to a tail page.
> In the case, VM_BUG_ON_PGFLAGS() in const_folio_flags() can be triggered.
> Remove the speculative call.
> 
> Also mark folio_test_lru() check right after folio_try_get() success as no
> more unlikely.
> 
> The race should be rare.  Also the problem can happen only if the kernel
> has enabled CONFIG_DEBUG_VM_PGFLAGS.  No real world report of this issue
> has been made so far.  This fix is based on only theoretical analysis.
> That said, a bug is a bug.  A similar issue was also fixed via commit
> 3203b3ab0fcf ("mm/filemap: don't call folio_test_locked() without a
> reference in next_uptodate_folio()").  I don't expect this change will
> make a meaningful impact to DAMON performance in the real world, though I
> will be happy to be corrected from the real world reports.
> 
> The issue was discovered [1] by Sashiko.
> 
> Link: https://lore.kernel.org/20260525162256.8317-1-sj@kernel.org
> Link: https://lore.kernel.org/20260517234112.89245-1-sj@kernel.org [1]
> Fixes: 3f49584b262c ("mm/damon: implement primitives for the virtual memory address spaces")
> Signed-off-by: SeongJae Park <sj@kernel.org>
> Cc: Fernand Sieber <sieberf@amazon.com>
> Cc: Leonard Foerster <foersleo@amazon.de>
> Cc: Shakeel Butt <shakeel.butt@linux.dev>
> Cc: <stable@vger.kernel.org> # 5.15.x
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>

Thank you for fixing the conflict, Sasha!

Reviewed-by: SeongJae Park <sj@kernel.org>


Thanks,
SJ

[...]