Re: [PATCH v3] samples/damon/mtier: fail early if address range parameters are invalid

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The sysfs interface allows creating zero-sized regions, leading to a division by zero kernel panic in `damon_merge_two_regions()` when merging adjacent zero-sized regions.
--

commit 049fc008d25fe73be336de6b00bf5512c8f6ec71
Author: Zenghui Yu <yuzenghui@huawei.com>

samples/damon/mtier: fail early if address range parameters are invalid

This commit fixes an issue where invalid node address ranges could trigger a
WARN_ONCE. It prevents zero-sized or negatively-sized regions by adding an
early failure check if the start address is greater than or equal to the end
address.

> diff --git a/samples/damon/mtier.c b/samples/damon/mtier.c
> index faaaaa12e6206..e567f4edd80ea 100644
> --- a/samples/damon/mtier.c
> +++ b/samples/damon/mtier.c
[ ... ]
> @@ -120,6 +120,9 @@ static struct damon_ctx *damon_sample_mtier_build_ctx(bool promote)
>  		addr.end = promote ? node1_end_addr : node0_end_addr;
>  	}
>  
> +	if (addr.start >= addr.end)
> +		goto free_out;
> +

[Severity: High]
This is a pre-existing issue, but while you are fixing zero-sized regions
here, does the DAMON sysfs interface have a similar vulnerability that can
cause a kernel panic?

Looking at damon_sysfs_set_regions() in mm/damon/sysfs.c, the bounds check
only uses strictly greater than instead of greater than or equal to:

    if (sys_region->ar.start > sys_region->ar.end)
            goto out;

If a user configures two identical zero-sized regions via sysfs (e.g.,
start=4096 and end=4096), this check passes. Furthermore, the overlap
check allows consecutive identical zero-sized regions because exact boundary
matches evaluate to false.

When DAMON executes damon_merge_regions_of(), it identifies these as
perfectly adjacent and attempts to merge them in damon_merge_two_regions():

mm/damon/core.c:damon_merge_two_regions() {
    ...
    l->nr_accesses = (l->nr_accesses * sz_l + r->nr_accesses * sz_r) /
            (sz_l + sz_r);
    ...
}

Since both regions are zero-sized, sz_l + sz_r evaluates to 0, which would
cause a division by zero kernel panic. Should the sysfs interface also be
updated to use >= to prevent this?

>  	range.start = addr.start;
>  	range.end = addr.end;
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260629144432.133962-1-sj@kernel.org?part=1