Re: [PATCH v5 1/2] mm/damon/lru_sort: validate min_region_size to be power of 2

[SeongJae Park <sj@kernel.org>]

On Fri, 01 May 2026 02:16:43 +0000 sashiko-bot@kernel.org wrote:

> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] A Time-of-Check to Time-of-Use (TOCTOU) race condition exists between the validation of `damon_lru_sort_mon_attrs.sample_interval` and its subsequent use, leading to a division-by-zero kernel panic.
> --
> 
> commit 27c4642b5b420a4c1731c9385273b591e05b5b4c
> Author: Liew Rui Yan <aethernet65535@gmail.com>
> 
> mm/damon/lru_sort: validate min_region_size to be power of 2
> 
> This commit adds early validation for the min_region_sz parameter to ensure
> it is a power of 2. It prevents kdamond from incorrectly terminating with
> the maybe_corrupted flag when a user simply sets an invalid addr_unit.
> 
> > diff --git a/mm/damon/lru_sort.c b/mm/damon/lru_sort.c
> > index 2eb559d913b62..eca88ed941b32 100644
> > --- a/mm/damon/lru_sort.c
> > +++ b/mm/damon/lru_sort.c
> > @@ -286,6 +286,11 @@ static int damon_lru_sort_apply_parameters(void)
> >  	param_ctx->addr_unit = addr_unit;
> >  	param_ctx->min_region_sz = max(DAMON_MIN_REGION_SZ / addr_unit, 1);
> >  
> > +	if (!is_power_of_2(param_ctx->min_region_sz)) {
> > +		err = -EINVAL;
> > +		goto out;
> > +	}
> > +
> >  	if (!damon_lru_sort_mon_attrs.sample_interval) {
> 
> This isn't a regression introduced by this patch,

So no blocker for this patch.

> but can a time-of-check
> to time-of-use (TOCTOU) race condition happen here?
> 
> Because damon_lru_sort_mon_attrs is exposed as a module parameter, it can
> be modified concurrently. If a user concurrently writes 0 to sample_interval
> immediately after this check passes, the local attrs struct would copy the
> new zero value:
> 
>     attrs = damon_lru_sort_mon_attrs;
> 
> Later in the function, damon_max_nr_accesses(&attrs) evaluates
> attrs.aggr_interval / attrs.sample_interval. Since sample_interval would
> be 0, could this trigger a divide-by-zero exception?

This cannot happen, as previously explained [1] to a similar question.

Seems Sashiko is not using mm-new as the baseline of DAMON patches, and
therefore does not know the fact we now doing this in synchronous manner.

[1] https://lore.kernel.org/20260429054135.91515-1-sj@kernel.org


Thanks,
SJ

[...]