Re: [PATCH] mm/damon/core: skip aging from repeated aggressive merging

On Sun, 12 Jul 2026 17:10:20 +0000 [email protected] wrote:

> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> 
> Pre-existing issues:
> - [High] `kdamond_merge_regions()` can fall into an infinite loop due to integer overflow of `threshold`.
> --
> 
> --- Patch [1]: [PATCH] mm/damon/core: skip aging from repeated aggressive merging ---
> commit 1fa7392cc3fc19083e90cfb01dcfa4f03ebbc373
> Author: SJ Park <[email protected]>
> 
> mm/damon/core: skip aging from repeated aggressive merging
> 
> This commit modifies the DAMON core to skip aging when repeating region
> merges during corner cases where the number of regions exceeds the
> user-defined maximum limit. This prevents temporary degradation of
> monitoring quality caused by updating region ages multiple times during
> repeated merge operations.
> 
> Link: https://lore.kernel.org/[email protected]
> Link: https://lore.kernel.org/[email protected]
> 
> > diff --git a/mm/damon/core.c b/mm/damon/core.c
> > --- a/mm/damon/core.c
> > +++ b/mm/damon/core.c
> [ ... ]
> > @@ -3366,15 +3368,18 @@ static void kdamond_merge_regions(struct damon_ctx *c, unsigned int threshold,
> >  	struct damon_target *t;
> >  	unsigned int nr_regions;
> >  	unsigned int max_thres;
> > +	bool count_age = true;
> >  
> >  	max_thres = c->attrs.aggr_interval /
> >  		(c->attrs.sample_interval ?  c->attrs.sample_interval : 1);
> >  	do {
> >  		nr_regions = 0;
> >  		damon_for_each_target(t, c) {
> > -			damon_merge_regions_of(t, threshold, sz_limit, c);
> > +			damon_merge_regions_of(t, threshold, sz_limit, c,
> > +					count_age);
> >  			nr_regions += damon_nr_regions(t);
> >  		}
> > +		count_age = false;
> >  		threshold = max(1, threshold * 2);
> >  	} while (nr_regions > c->attrs.max_nr_regions &&
> >  			threshold / 2 < max_thres);
> 
> [Severity: High]
> This is a pre-existing issue, but can kdamond_merge_regions() fall into an
> infinite loop under certain configurations?
> 
> If a user configures aggr_interval and sample_interval such that their
> quotient (max_thres) exceeds 0x40000000, threshold could overflow in the
> max() assignment above. 
> 
> Since threshold is an unsigned int, doubling it once it reaches 0x80000000
> causes an overflow to 0, which max(1, 0) clamps back to 1.
> 
> If regions cannot be merged further due to the sz_limit constraint,
> nr_regions > c->attrs.max_nr_regions remains true indefinitely.
> 
> Because threshold cycles and never exceeds 0xFFFFFFFF, threshold / 2 never
> reaches max_thres, causing this loop condition to evaluate to true endlessly.

Another patch [1] for the issue is under review.

[1] https://lore.kernel.org/[email protected]

> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1


Thanks,
SJ