Re: [PATCH 8/8] mm/damon/sysfs: remove region size validation

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Removal of region size validation allows accepting negative size regions which are then silently transformed into valid positive size regions.
--

commit 9f8b624e84e757e30369d491c2b454f3896c87c7
Author: SJ Park <sj@kernel.org>

mm/damon/sysfs: remove region size validation

This commit removes the region size validation in DAMON sysfs, relying on the
assumption that damon_set_regions() performs complete validation.

> diff --git a/mm/damon/sysfs.c b/mm/damon/sysfs.c
> index e666dddf1feba..b65651498e0d1 100644
> --- a/mm/damon/sysfs.c
> +++ b/mm/damon/sysfs.c
> @@ -1987,9 +1987,6 @@ static int damon_sysfs_set_regions(struct damon_target *t,
>  		struct damon_sysfs_region *sys_region =
>  			sysfs_regions->regions_arr[i];
>  
> -		if (sys_region->ar.start > sys_region->ar.end)
> -			goto out;
> -

[Severity: Medium]
Does removing this check allow invalid input to be silently accepted?

If a user configures a region via sysfs where start is greater than end,
damon_set_regions() might still accept it because the alignment happens
before the size validation:

mm/damon/core.c:damon_set_regions() {
        ...
        start = ALIGN_DOWN(ranges[i].start, min_region_sz);
        end = ALIGN(ranges[i].end, min_region_sz);
        if (start >= end)
                return -EINVAL;
        ...
}

If the user provides start = 100 and end = 50, and min_region_sz is 4096,
the alignment step evaluates start to 0 and end to 4096.

This causes the subsequent check to see 0 >= 4096 (which is false), silently
mutating the invalid negative-sized region into a valid positive size region
instead of rejecting it.

>  		ranges[i].start = sys_region->ar.start;
>  		ranges[i].end = sys_region->ar.end;
>  		if (i == 0)

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260705155600.96555-1-sj@kernel.org?part=8