Re: [RFC PATCH 2/8] mm/damon/core: commit hugepage_size type damon filter

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Missing initialization and validation of `range_min` and `range_max` for newly appended `hugepage_size` filters leads to uninitialized memory usage.
--

commit 2b0a5f30b2fda9db59b511fc77d64fcbd35378ca
Author: SJ Park <sj@kernel.org>

mm/damon/core: commit hugepage_size type damon filter

Extend data attribute probe filters commit logic for the new
hugepage_size filter type.  Since it needs to carry the size range of
the hugepage, update the logic to update the size range fields of the
commit destination filter struct.

> diff --git a/mm/damon/core.c b/mm/damon/core.c
> index 0c98f7e267d07..a3febdc355c1e 100644
> --- a/mm/damon/core.c
> +++ b/mm/damon/core.c

[ ... ]

> @@ -1807,23 +1807,33 @@ static void damon_commit_filter(struct damon_filter *dst,
>  	case DAMON_FILTER_TYPE_MEMCG:
>  		dst->memcg_id = src->memcg_id;
>  		break;
> +	case DAMON_FILTER_TYPE_HUGEPAGE_SIZE:
> +		if (src->range_max < src->range_min)
> +			return -EINVAL;
> +		dst->range_min = src->range_min;
> +		dst->range_max = src->range_max;
> +		break;
>  	default:
>  		break;
>  	}
> +	return 0;
>  }
>  
>  static int damon_commit_filters(struct damon_probe *dst,
>  		struct damon_probe *src)
>  {

[ ... ]

>  	damon_for_each_filter_safe(src_filter, next, src) {
>  		if (j++ < i)
>  			continue;
>  
>  		new_filter = damon_new_filter(src_filter->type,
>  				src_filter->matching, src_filter->allow);
>  		if (!new_filter)
>  			return -ENOMEM;
>  		switch (src_filter->type) {
>  		case DAMON_FILTER_TYPE_MEMCG:
>  			new_filter->memcg_id = src_filter->memcg_id;
>  			break;
>  		default:
>  			break;
>  		}
>  		damon_add_filter(dst, new_filter);

[Severity: High]
Does this code leave range_min and range_max uninitialized for newly
appended hugepage_size filters?

If a user writes a new hugepage_size filter to a running probe via sysfs,
it triggers the filter appending path here:
damon_commit_ctx() -> damon_commit_probes() -> damon_commit_filters()

When the new filter is appended, damon_new_filter() allocates memory with
kmalloc(), which does not zero-initialize the memory. The switch statement
then omits copying range_min and range_max for
DAMON_FILTER_TYPE_HUGEPAGE_SIZE, leaving them as uninitialized heap garbage.

This makes the hugepage_size filter unpredictable and could cause incorrect
memory pages to be filtered in or out. It also completely bypasses the
validation logic added for existing filters in damon_commit_filter().

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260913171133.102366-1-sj@kernel.org?part=2