Re: [RFC PATCH v3 5/8] mm/damon/sysfs: support hugepage_size probe filter

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] mm: partial commit failure in damon_commit_filter() causes DAMON context state corruption
--

commit bba894847aad85f23c968a2f306ec06c6e1b1a8c
Author: SJ Park <sj@kernel.org>

mm/damon/sysfs: support hugepage_size probe filter
    
Extend DAMON sysfs interface to support hugepage_size probe filter.
Allows hugepage_size user string input to the filter type file.  Pass
the size range argument that users set via min/max files under the probe
filter directory to the DAMON core.

> diff --git a/mm/damon/sysfs.c b/mm/damon/sysfs.c
> index 8e8d89b8ed981..43519afb9eb7f 100644
> --- a/mm/damon/sysfs.c
> +++ b/mm/damon/sysfs.c
[ ... ]
> @@ -2273,6 +2277,9 @@ static int damon_sysfs_set_filters(struct damon_probe *probe,
>  				damon_destroy_filter(filter);
>  				return err;
>  			}
> +		} else if (filter->type == DAMON_FILTER_TYPE_HUGEPAGE_SIZE) {
> +			filter->range_min = sys_filter->range_min;
> +			filter->range_max = sys_filter->range_max;
>  		}

[Severity: High]
Can an invalid hugepage_size range (where range_min > range_max) cause state
corruption in the DAMON context?

When a user configures a hugepage_size filter with range_min > range_max,
the values are copied blindly here into the intermediate context without
validation.

During the subsequent commit, damon_commit_filter() in mm/damon/core.c
updates the destination filter:

mm/damon/core.c:damon_commit_filter() {
	dst->type = src->type;
	dst->matching = src->matching;
	dst->allow = src->allow;
	switch (dst->type) {
	case DAMON_FILTER_TYPE_MEMCG:
		dst->memcg_id = src->memcg_id;
		break;
	case DAMON_FILTER_TYPE_HUGEPAGE_SIZE:
		if (src->range_max < src->range_min)
			return -EINVAL;
...
}

Because the validation fails and returns -EINVAL after dst->type,
dst->matching, and dst->allow have already been updated, the commit aborts
midway. This leaves the active DAMON context's filter partially mutated,
interpreting its previous union field (like memcg_id) as the new range
bounds.

Could validation be added to damon_sysfs_set_filters() in mm/damon/sysfs.c
to prevent invalid bounds from reaching the core commit logic?

>  		damon_add_filter(probe, filter);
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260915020929.102953-1-sj@kernel.org?part=5