Re: [RFC PATCH v1.1 02/14] mm/damon/core: do not use region out of a loop in damon_set_regions()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Integer overflow in ALIGN() can result in region with ar.end = 0
--

commit d65dcd33c6063ed27bd90da3803c482628ebbc88
Author: SeongJae Park <sj@kernel.org>

mm/damon/core: do not use region out of a loop in damon_set_regions()

This commit cleans up damon_set_regions() to explicitly track if a region
should be inserted before another, avoiding reliance on undocumented
iterator behavior. No behavioral changes are intended.

> diff --git a/mm/damon/core.c b/mm/damon/core.c
> index d0bdf6e01dff8..669fd13776ea2 100644
> --- a/mm/damon/core.c
> +++ b/mm/damon/core.c

[ ... ]

> @@ -394,7 +397,11 @@ int damon_set_regions(struct damon_target *t, struct damon_addr_range *ranges,
>  					ALIGN(range->end, min_region_sz));

[Severity: High]
This is a pre-existing issue, but can this ALIGN() macro overflow if
userspace provides ULONG_MAX as the region end via the sysfs interface?

If range->end is ULONG_MAX and min_region_sz is 4096, the ALIGN() macro
would evaluate to 0, resulting in a region where ar.end is 0.

When damon_sz_region() subsequently calculates the size using
r->ar.end - r->ar.start, the unsigned arithmetic would underflow to a
massive size.

This could cause the while (damon_sz_region(r) > max_region_sz) loop in
damon_apply_min_nr_regions() to iterate nearly endlessly, allocating new
regions until memory is exhausted.

>  			if (!newr)
>  				return -ENOMEM;
> -			damon_insert_region(newr, damon_prev_region(r), r, t);
> +			if (insert_before_r)
> +				damon_insert_region(newr, damon_prev_region(r),
> +						r, t);
> +			else
> +				damon_add_region(newr, t);
>  		} else {
>  			/* resize intersecting regions to fit in this range */
>  			first->ar.start = ALIGN_DOWN(range->start,

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260521035349.87565-1-sj@kernel.org?part=2