[RFC PATCH 0/5] mm/damon: unurgent fixes for infinite loop, NULL de-ref and races

[SJ Park]

Sashiko found a few issues in DAMON that could cause infinite loop, NULL
dereference and monitoring results degradation. The first two sounds
scary but the infinite loop happens only under unreasonable user setup.
The NULL dereference is only in a unit test. Monitoring results
degradation is trivial since it is only best-effort, and those happens
from only unlikely races. Still those are bugs that better to fix if
possible. Fix those.

SJ Park (5):
mm/damon/core: avoid infinite kdamond_merge_regions() internal loop
mm/damon/tests/core-kunit: catch test failure in
test_merge_regions_of()
mm/damon/vaddr: drop last same folio access check optimization
mm/damon/paddr: drop last same folio access check reuse optimization
mm/damon/sysfs: read ops_id only once

mm/damon/core.c | 13 +++++++++----
mm/damon/paddr.c | 20 ++++----------------
mm/damon/sysfs.c | 6 ++++--
mm/damon/tests/core-kunit.h | 3 +++
mm/damon/vaddr.c | 26 ++++----------------------
5 files changed, 24 insertions(+), 44 deletions(-)


base-commit: 65b3b6001701d46d5360097bdc90dfa1c06a1239
--
2.47.3

[SJ Park]

KUNIT_EXPECT_EQ() does not abort the execution of test code when the
expectation is not met. But damon_test_merge_regions_of() code after
its initial KUNIT_EXPECT_EQ() call assumes the expectation is met. It
does a per-region test with a hard-coded number of regions that is
correct only if the expectation was met. As a result, __nth_region_of()
could return NULL, and the test code can dereference NULL pointers. Fix
the issue by catching the expectation failure and skip the per-region
tests.

The user impact on realistic setups should be negligible, as it is a
unit test.

The issue was discovered [1] by Sashiko.

[1] https://lore.kernel.org/202607101449...@kernel.org

Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests")
Cc: <sta...@vger.kernel.org> # 5.15.x
Signed-off-by: SJ Park <s...@kernel.org>
---
mm/damon/tests/core-kunit.h | 3 +++
1 file changed, 3 insertions(+)

diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h
index 68d30648c612e..fb882a0602ff9 100644
--- a/mm/damon/tests/core-kunit.h
+++ b/mm/damon/tests/core-kunit.h
@@ -260,11 +260,14 @@ static void damon_test_merge_regions_of(struct kunit *test)
damon_merge_regions_of(t, 9, 9999, ctx, true);
/* 0-112, 114-130, 130-156, 156-170, 170-230, 230-10170 */
KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 6u);
+ if (damon_nr_regions(t) != 6)
+ goto out;
for (i = 0; i < 6; i++) {
r = __nth_region_of(t, i);
KUNIT_EXPECT_EQ(test, r->ar.start, saddrs[i]);
KUNIT_EXPECT_EQ(test, r->ar.end, eaddrs[i]);
}
+out:
damon_free_target(t);
damon_destroy_ctx(ctx);
}
--
2.47.3

[SJ Park]

Sashiko found a few issues in DAMON that could cause infinite loop, NULL
dereference and monitoring results degradation. The first two sounds
scary but the infinite loop happens only under unreasonable user setup.
The NULL dereference is only in a unit test. Monitoring results
degradation is trivial since it is only best-effort, and those happens
from only unlikely races. Still those are bugs that better to fix if
possible. Fix those.

Changes from RFC
- RFC: https://lore.kernel.org/202607111804...@kernel.org
- Rebase to mm-new.

SJ Park (5):
mm/damon/core: avoid infinite kdamond_merge_regions() internal loop
mm/damon/tests/core-kunit: catch test failure in
test_merge_regions_of()
mm/damon/vaddr: drop last same folio access check optimization
mm/damon/paddr: drop last same folio access check reuse optimization
mm/damon/sysfs: read ops_id only once

mm/damon/core.c | 13 +++++++++----
mm/damon/paddr.c | 20 ++++----------------
mm/damon/sysfs.c | 6 ++++--
mm/damon/tests/core-kunit.h | 3 +++
mm/damon/vaddr.c | 26 ++++----------------------
5 files changed, 24 insertions(+), 44 deletions(-)

base-commit: df701015aac3c13b1ecff311fda1a2ada2b9c1b2
--
2.47.3

[SJ Park]

KUNIT_EXPECT_EQ() does not abort the execution of test code when the
expectation is not met. But damon_test_merge_regions_of() code after
its initial KUNIT_EXPECT_EQ() call assumes the expectation is met. It
does a per-region test with a hard-coded number of regions that is
correct only if the expectation was met. As a result, __nth_region_of()
could return NULL, and the test code can dereference NULL pointers. Fix
the issue by catching the expectation failure and skip the per-region
tests.

The user impact on realistic setups should be negligible, as it is a
unit test.

The issue was discovered [1] by Sashiko.

[1] https://lore.kernel.org/202607101449...@kernel.org

Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests")
Cc: <sta...@vger.kernel.org> # 5.15.x
Signed-off-by: SJ Park <s...@kernel.org>
---
mm/damon/tests/core-kunit.h | 3 +++
1 file changed, 3 insertions(+)

diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h

index 6ad73559dd8ea..a99363720e677 100644

--- a/mm/damon/tests/core-kunit.h
+++ b/mm/damon/tests/core-kunit.h
@@ -260,11 +260,14 @@ static void damon_test_merge_regions_of(struct kunit *test)

damon_merge_regions_of(t, 9, 9999, ctx);

[SJ Park]

[SJ Park]

Sashiko found a few issues in DAMON that could cause infinite loop, NULL
dereference and monitoring results degradation. The first two sounds
scary but the infinite loop happens only under unreasonable user setup.
The NULL dereference is only in a unit test. Monitoring results
degradation is trivial since it is only best-effort, and those happens
from only unlikely races. Still those are bugs that better to fix if
possible. Fix those.

Changes from RFC v1.1
- RFC v1.1: https://lore.kernel.org/202607121703...@kernel.org
- Remove same_target param from __damon_va_check_access().

Changes from RFC
- RFC: https://lore.kernel.org/202607111804...@kernel.org
- Rebase to mm-new.

SJ Park (5):
mm/damon/core: avoid infinite kdamond_merge_regions() internal loop
mm/damon/tests/core-kunit: catch test failure in
test_merge_regions_of()
mm/damon/vaddr: drop last same folio access check optimization
mm/damon/paddr: drop last same folio access check reuse optimization
mm/damon/sysfs: read ops_id only once

mm/damon/core.c | 13 +++++++++----
mm/damon/paddr.c | 20 ++++----------------
mm/damon/sysfs.c | 6 ++++--
mm/damon/tests/core-kunit.h | 3 +++

mm/damon/vaddr.c | 33 ++++++---------------------------
5 files changed, 26 insertions(+), 49 deletions(-)


base-commit: 9d192aa422c3f9c503a40e5eb98093df671accf8
--
2.47.3

[SJ Park]

KUNIT_EXPECT_EQ() does not abort the execution of test code when the
expectation is not met. But damon_test_merge_regions_of() code after
its initial KUNIT_EXPECT_EQ() call assumes the expectation is met. It
does a per-region test with a hard-coded number of regions that is
correct only if the expectation was met. As a result, __nth_region_of()
could return NULL, and the test code can dereference NULL pointers. Fix
the issue by catching the expectation failure and skip the per-region
tests.

The user impact on realistic setups should be negligible, as it is a
unit test.

The issue was discovered [1] by Sashiko.

[1] https://lore.kernel.org/202607101449...@kernel.org

Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests")
Cc: <sta...@vger.kernel.org> # 5.15.x
Signed-off-by: SJ Park <s...@kernel.org>
---
mm/damon/tests/core-kunit.h | 3 +++
1 file changed, 3 insertions(+)

diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h

index 485472ddebd19..eba643762132f 100644

--- a/mm/damon/tests/core-kunit.h
+++ b/mm/damon/tests/core-kunit.h
@@ -260,11 +260,14 @@ static void damon_test_merge_regions_of(struct kunit *test)

damon_merge_regions_of(t, 9, 9999, ctx, true);

[SJ Park]

Sashiko found a few issues in DAMON that could cause infinite loop, NULL
dereference and monitoring results degradation. The first two sounds
scary but the infinite loop happens only under unreasonable user setup.
The NULL dereference is only in a unit test. Monitoring results
degradation is trivial since it is only best-effort, and those happens
from only unlikely races. Still those are bugs that better to fix if
possible. Fix those.

Changes from RFC v1.2
- RFC v1.2: https://lore.kernel.org/202607131358...@kernel.org
- Drop RFC tag.
- Rebase to latest mm-new.

Changes from RFC v1.1
- RFC v1.1: https://lore.kernel.org/202607121703...@kernel.org
- Remove same_target param from __damon_va_check_access().
Changes from RFC
- RFC: https://lore.kernel.org/202607111804...@kernel.org
- Rebase to mm-new.

SJ Park (5):
mm/damon/core: avoid infinite kdamond_merge_regions() internal loop
mm/damon/tests/core-kunit: catch test failure in
test_merge_regions_of()
mm/damon/vaddr: drop last same folio access check optimization
mm/damon/paddr: drop last same folio access check reuse optimization
mm/damon/sysfs: read ops_id only once

mm/damon/core.c | 13 +++++++++----
mm/damon/paddr.c | 20 ++++----------------
mm/damon/sysfs.c | 6 ++++--
mm/damon/tests/core-kunit.h | 3 +++
mm/damon/vaddr.c | 33 ++++++---------------------------
5 files changed, 26 insertions(+), 49 deletions(-)

base-commit: 93cecef8d85fe01bc004e07591501e85c132b343
--
2.47.3

[SJ Park]

On Tue, 14 Jul 2026 06:52:28 -0700 SJ Park <s...@kernel.org> wrote:

> Sashiko found a few issues in DAMON that could cause infinite loop, NULL
> dereference and monitoring results degradation. The first two sounds
> scary but the infinite loop happens only under unreasonable user setup.
> The NULL dereference is only in a unit test. Monitoring results
> degradation is trivial since it is only best-effort, and those happens
> from only unlikely races. Still those are bugs that better to fix if
> possible. Fix those.

Sashiko found one more bug that may better to be fixed together with this
series. Also patch 5 mistakenly lacks its Fixes: tag. I will post a new
version of this series with the fixes. Please don't pick this series into
mm-new for now.


Thanks,
SJ

[...]

[SJ Park]

[SJ Park]

Sashiko found a few issues in DAMON that could cause infinite loop, NULL
dereference and monitoring results degradation. The first two sounds
scary but the infinite loop happens only under unreasonable user setup.
The NULL dereference is only in a unit test. Monitoring results
degradation is trivial since it is only best-effort, and those happens
from only unlikely races. Still those are bugs that better to fix if
possible. Fix those.

Changes from v1
- v1: https://lore.kernel.org/202607141352...@kernel.org
- Add addr_unit race fix.
- Add Fixes: tags to the race fixes.
- Wordsmith subjects.

Changes from RFC v1.2
- RFC v1.2: https://lore.kernel.org/202607131358...@kernel.org
- Drop RFC tag.
- Rebase to latest mm-new.
Changes from RFC v1.1
- RFC v1.1: https://lore.kernel.org/202607121703...@kernel.org
- Remove same_target param from __damon_va_check_access().
Changes from RFC
- RFC: https://lore.kernel.org/202607111804...@kernel.org
- Rebase to mm-new.

SJ Park (6):

mm/damon/core: avoid infinite kdamond_merge_regions() internal loop
mm/damon/tests/core-kunit: catch test failure in
test_merge_regions_of()
mm/damon/vaddr: drop last same folio access check optimization
mm/damon/paddr: drop last same folio access check reuse optimization

mm/damon/sysfs: read addr_unit only once in damon_sysfs_apply_inputs()
mm/damon/sysfs: read ops_id only once in damon_sysfs_apply_inputs()

mm/damon/core.c | 13 +++++++++----
mm/damon/paddr.c | 20 ++++----------------

mm/damon/sysfs.c | 10 ++++++----

mm/damon/tests/core-kunit.h | 3 +++
mm/damon/vaddr.c | 33 ++++++---------------------------

5 files changed, 28 insertions(+), 51 deletions(-)


base-commit: 52d335d2c1de60b6184b9de5ecec634892a3e136
--
2.47.3

[SJ Park]

On Tue, 14 Jul 2026 20:09:55 -0700 SJ Park <s...@kernel.org> wrote:

> Sashiko found a few issues in DAMON that could cause infinite loop, NULL
> dereference and monitoring results degradation. The first two sounds
> scary but the infinite loop happens only under unreasonable user setup.
> The NULL dereference is only in a unit test. Monitoring results
> degradation is trivial since it is only best-effort, and those happens
> from only unlikely races. Still those are bugs that better to fix if
> possible. Fix those.

Sashiko found no blocker for this series. Sashiko sent findings to damon@
mailing list [1], and I replied to all the comments. Please read those for
details.

[1] https://lore.kernel.org/damon/


Thanks,
SJ

[...]

[Andrew Morton]

On Tue, 14 Jul 2026 20:09:55 -0700 SJ Park <s...@kernel.org> wrote:

> Sashiko found a few issues in DAMON that could cause infinite loop, NULL
> dereference and monitoring results degradation. The first two sounds
> scary but the infinite loop happens only under unreasonable user setup.
> The NULL dereference is only in a unit test. Monitoring results
> degradation is trivial since it is only best-effort, and those happens
> from only unlikely races. Still those are bugs that better to fix if
> possible. Fix those.

> Subject: [PATCH v1.1 0/6] ...

So... what is the significance of "1.1" here?

[SJ Park]

As the changelog says, one more unurgent fix (patch 5 of this sereis) has added
on top of the v1.

Maybe my versioning scheme is confusing you. I increase minor version when it
is purely for findings from Sashiko and if the change seems not really big. I
do so because I realized it is easy to get version number large in short term
when I respect Sashiko, and it may look confusing for some people. Maybe a
better approach is running Sashiko in my local, but I don't have AI setup in my
development environment... Let me know if this only confuses and bothers you
and you have a suggestion.


Thanks,
SJ