Re: [RFC PATCH 6/8] mm/damon: document region size validation in damon_set_regions()

[SJ Park <sj@kernel.org>]

On Wed, 01 Jul 2026 16:04:18 +0000 sashiko-bot@kernel.org wrote:

> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] The documentation incorrectly claims `damon_set_regions()` validates region sizes, which led to the removal of input validation in callers, resulting in a kernel OOM panic when negative-sized regions are processed.
> --
> 
> commit d4cdfb1871ad152ec6d79d41fca7f1497b7467a0
> Author: SJ Park <sj@kernel.org>
> 
> mm/damon: document region size validation in damon_set_regions()
> 
> This commit updates the documentation for the damon_region struct. It
> clarifies that callers can pass any values for region addresses because
> damon_set_regions() validates that regions have a positive size.
> 
> > diff --git a/include/linux/damon.h b/include/linux/damon.h
> > --- a/include/linux/damon.h
> > +++ b/include/linux/damon.h
> > @@ -51,7 +51,8 @@ struct damon_size_range {
> >   * @list:		List head for siblings.
> >   * @age:		Age of this region.
> >   *
> > - * For any use case, @ar should be non-zero positive size.
> > + * For any use case, @ar should be non-zero positive size.  damon_set_regions()
> > + * does the validation.
> 
> [Severity: High]
> Does this documentation accurately reflect the implementation?
> 
> Looking at damon_set_regions() in mm/damon/core.c, it lacks checks for
> start >= end before passing boundaries to damon_new_region():

As I noted on the cover letter, the check is not yet merged into mm.git.

> 
> mm/damon/core.c:damon_set_regions() {
>     ...
> 			r = damon_new_region(
> 					ALIGN_DOWN(ranges[i].start,
> 						min_region_sz),
> 					ALIGN(ranges[i].end, min_region_sz));
>     ...
> }
> 
> If a region is created with start >= end, would damon_sz_region() underflow
> to ULONG_MAX?
> 
> This enormous size could trigger an infinite memory allocation loop in
> damon_apply_min_nr_regions() which repeatedly calls damon_split_region_at():
> 
> mm/damon/core.c:damon_apply_min_nr_regions() {
>     ...
> 			while (damon_sz_region(r) > max_region_sz) {
> 				damon_split_region_at(t, r, max_region_sz);
> 				r = damon_next_region(r);
> 			}
>     ...
> }
> 
> Since a subsequent patch in the series (mm/damon/sysfs: remove region size
> validation) relies on this guarantee to remove the validation from sysfs,
> could a user writing a region with start >= end to the DAMON sysfs interface
> trigger an Out-of-Memory kernel panic?

So no issue.


Thanks,
SJ

[...]