Re: [RFC PATCH 6/8] mm/damon: document region size validation in damon_set_regions()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The documentation incorrectly claims `damon_set_regions()` validates region sizes, which led to the removal of input validation in callers, resulting in a kernel OOM panic when negative-sized regions are processed.
--

commit d4cdfb1871ad152ec6d79d41fca7f1497b7467a0
Author: SJ Park <sj@kernel.org>

mm/damon: document region size validation in damon_set_regions()

This commit updates the documentation for the damon_region struct. It
clarifies that callers can pass any values for region addresses because
damon_set_regions() validates that regions have a positive size.

> diff --git a/include/linux/damon.h b/include/linux/damon.h
> --- a/include/linux/damon.h
> +++ b/include/linux/damon.h
> @@ -51,7 +51,8 @@ struct damon_size_range {
>   * @list:		List head for siblings.
>   * @age:		Age of this region.
>   *
> - * For any use case, @ar should be non-zero positive size.
> + * For any use case, @ar should be non-zero positive size.  damon_set_regions()
> + * does the validation.

[Severity: High]
Does this documentation accurately reflect the implementation?

Looking at damon_set_regions() in mm/damon/core.c, it lacks checks for
start >= end before passing boundaries to damon_new_region():

mm/damon/core.c:damon_set_regions() {
    ...
			r = damon_new_region(
					ALIGN_DOWN(ranges[i].start,
						min_region_sz),
					ALIGN(ranges[i].end, min_region_sz));
    ...
}

If a region is created with start >= end, would damon_sz_region() underflow
to ULONG_MAX?

This enormous size could trigger an infinite memory allocation loop in
damon_apply_min_nr_regions() which repeatedly calls damon_split_region_at():

mm/damon/core.c:damon_apply_min_nr_regions() {
    ...
			while (damon_sz_region(r) > max_region_sz) {
				damon_split_region_at(t, r, max_region_sz);
				r = damon_next_region(r);
			}
    ...
}

Since a subsequent patch in the series (mm/damon/sysfs: remove region size
validation) relies on this guarantee to remove the validation from sysfs,
could a user writing a region with start >= end to the DAMON sysfs interface
trigger an Out-of-Memory kernel panic?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260701144815.113325-1-sj@kernel.org?part=6