Re: [PATCH v5 1/2] mm/damon/lru_sort: validate min_region_size to be power of 2

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] A Time-of-Check to Time-of-Use (TOCTOU) race condition exists between the validation of `damon_lru_sort_mon_attrs.sample_interval` and its subsequent use, leading to a division-by-zero kernel panic.
--

commit 27c4642b5b420a4c1731c9385273b591e05b5b4c
Author: Liew Rui Yan <aethernet65535@gmail.com>

mm/damon/lru_sort: validate min_region_size to be power of 2

This commit adds early validation for the min_region_sz parameter to ensure
it is a power of 2. It prevents kdamond from incorrectly terminating with
the maybe_corrupted flag when a user simply sets an invalid addr_unit.

> diff --git a/mm/damon/lru_sort.c b/mm/damon/lru_sort.c
> index 2eb559d913b62..eca88ed941b32 100644
> --- a/mm/damon/lru_sort.c
> +++ b/mm/damon/lru_sort.c
> @@ -286,6 +286,11 @@ static int damon_lru_sort_apply_parameters(void)
>  	param_ctx->addr_unit = addr_unit;
>  	param_ctx->min_region_sz = max(DAMON_MIN_REGION_SZ / addr_unit, 1);
>  
> +	if (!is_power_of_2(param_ctx->min_region_sz)) {
> +		err = -EINVAL;
> +		goto out;
> +	}
> +
>  	if (!damon_lru_sort_mon_attrs.sample_interval) {

This isn't a regression introduced by this patch, but can a time-of-check
to time-of-use (TOCTOU) race condition happen here?

Because damon_lru_sort_mon_attrs is exposed as a module parameter, it can
be modified concurrently. If a user concurrently writes 0 to sample_interval
immediately after this check passes, the local attrs struct would copy the
new zero value:

    attrs = damon_lru_sort_mon_attrs;

Later in the function, damon_max_nr_accesses(&attrs) evaluates
attrs.aggr_interval / attrs.sample_interval. Since sample_interval would
be 0, could this trigger a divide-by-zero exception?

>  		err = -EINVAL;
>  		goto out;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260501013750.71704-1-aethernet65535@gmail.com?part=1