Re: [PATCH v3] samples/damon/mtier: fail early if address range parameters are invalid

[SJ Park <sj@kernel.org>]

On Mon, 29 Jun 2026 15:01:15 +0000 sashiko-bot@kernel.org wrote:

> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> 
> Pre-existing issues:
> - [High] The sysfs interface allows creating zero-sized regions, leading to a division by zero kernel panic in `damon_merge_two_regions()` when merging adjacent zero-sized regions.
> --
> 
> commit 049fc008d25fe73be336de6b00bf5512c8f6ec71
> Author: Zenghui Yu <yuzenghui@huawei.com>
> 
> samples/damon/mtier: fail early if address range parameters are invalid
> 
> This commit fixes an issue where invalid node address ranges could trigger a
> WARN_ONCE. It prevents zero-sized or negatively-sized regions by adding an
> early failure check if the start address is greater than or equal to the end
> address.
> 
> > diff --git a/samples/damon/mtier.c b/samples/damon/mtier.c
> > index faaaaa12e6206..e567f4edd80ea 100644
> > --- a/samples/damon/mtier.c
> > +++ b/samples/damon/mtier.c
> [ ... ]
> > @@ -120,6 +120,9 @@ static struct damon_ctx *damon_sample_mtier_build_ctx(bool promote)
> >  		addr.end = promote ? node1_end_addr : node0_end_addr;
> >  	}
> >  
> > +	if (addr.start >= addr.end)
> > +		goto free_out;
> > +
> 
> [Severity: High]
> This is a pre-existing issue,

So no blocker of this patch.

> but while you are fixing zero-sized regions
> here, does the DAMON sysfs interface have a similar vulnerability that can
> cause a kernel panic?
> 
> Looking at damon_sysfs_set_regions() in mm/damon/sysfs.c, the bounds check
> only uses strictly greater than instead of greater than or equal to:
> 
>     if (sys_region->ar.start > sys_region->ar.end)
>             goto out;
> 
> If a user configures two identical zero-sized regions via sysfs (e.g.,
> start@96 and end@96), this check passes. Furthermore, the overlap
> check allows consecutive identical zero-sized regions because exact boundary
> matches evaluate to false.
> 
> When DAMON executes damon_merge_regions_of(), it identifies these as
> perfectly adjacent and attempts to merge them in damon_merge_two_regions():
> 
> mm/damon/core.c:damon_merge_two_regions() {
>     ...
>     l->nr_accesses = (l->nr_accesses * sz_l + r->nr_accesses * sz_r) /
>             (sz_l + sz_r);
>     ...
> }
> 
> Since both regions are zero-sized, sz_l + sz_r evaluates to 0, which would
> cause a division by zero kernel panic. Should the sysfs interface also be
> updated to use >= to prevent this?

Correct.  And we are working [1] on the fix.

[1] https://lore.kernel.org/20260628165447.86217-1-sj@kernel.org


Thanks,
SJ

[...]