[PATCH 6.18.y] samples/damon/mtier: fail early if address range parameters are invalid

[PATCH 6.18.y] samples/damon/mtier: fail early if address range parameters are invalid

[SJ Park]

From: Zenghui Yu <yuzenghui@huawei.com>

The comment on top of `struct damon_region` clearly says that

    For any use case, @ar should be non-zero positive size.

which is now verified in damon_verify_new_region() if the kernel is built
with DAMON_DEBUG_SANITY.

The WARN_ONCE() can be triggered if the mtier sample module is enabled
before node{0,1}_{start,end}_addr have been properly initialized, which is
obviously not good.

 ------------[ cut here ]------------
 start 0 >= end 0
 WARNING: mm/damon/core.c:217 at damon_new_region+0xf4/0x118, CPU#59: bash/341468
 Call trace:
  damon_new_region+0xf4/0x118 (P)
  damon_set_regions+0xfc/0x3c0
  damon_sample_mtier_build_ctx+0xe8/0x3a8
  damon_sample_mtier_start+0x1c/0x90
  damon_sample_mtier_enable_store+0x98/0xb0
  param_attr_store+0xb4/0x128
  module_attr_store+0x2c/0x50
  sysfs_kf_write+0x58/0x90
  kernfs_fop_write_iter+0x16c/0x238
  vfs_write+0x2c0/0x370
  ksys_write+0x74/0x118
  __arm64_sys_write+0x24/0x38
  invoke_syscall+0xa8/0x118
  el0_svc_common.constprop.0+0x48/0xf0
  do_el0_svc+0x24/0x38
  el0_svc+0x54/0x370
  el0t_64_sync_handler+0xa0/0xe8
  el0t_64_sync+0x1ac/0x1b0
 ---[ end trace 0000000000000000 ]---

Note that the same issue can happen if detect_node_addresses is true, and
node 0 or 1 is memoryless.  Fix it together by checking the validity of
parameters right before damon_new_region() and fail early if they're
invalid.

Link: https://lore.kernel.org/20260629144432.133962-1-sj@kernel.org
Fixes: 82a08bde3cf7 ("samples/damon: implement a DAMON module for memory tiering")
Signed-off-by: Zenghui Yu <yuzenghui@huawei.com>
Signed-off-by: SJ Park <sj@kernel.org>
Reviewed-by: SJ Park <sj@kernel.org>
Cc: <stable@vger.kernel.org> # 6.16.x
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
(cherry picked from commit 7746d72c64054976887928d64d2caf25c5a6dcc0)
Signed-off-by: SJ Park <sj@kernel.org>
---
 samples/damon/mtier.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/samples/damon/mtier.c b/samples/damon/mtier.c
index 775838a23d935..dab8fb10b617a 100644
--- a/samples/damon/mtier.c
+++ b/samples/damon/mtier.c
@@ -120,6 +120,8 @@ static struct damon_ctx *damon_sample_mtier_build_ctx(bool promote)
 		addr.end = promote ? node1_end_addr : node0_end_addr;
 	}
 
+	if (addr.start >= addr.end)
+		goto free_out;
 	region = damon_new_region(addr.start, addr.end);
 	if (!region)
 		goto free_out;
-- 
2.47.3

Re: [PATCH 6.18.y] samples/damon/mtier: fail early if address range parameters are invalid

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing validation in DAMON mtier module leading to division by zero
- [Medium] Memory leak of damon_ctx on damon_start() failure in sample modules
--

--- Patch [1]: [PATCH 6.18.y] samples/damon/mtier: fail early if address range parameters are invalid ---
commit 5cd52e0f168fe2427f3477f7a3e8f97bec2d9dca
Author: Zenghui Yu <yuzenghui@huawei.com>

samples/damon/mtier: fail early if address range parameters are invalid

This commit adds a sanity check to damon_sample_mtier_build_ctx() to ensure
the starting address is less than the ending address. If the range is
invalid, it fails early to prevent triggering a WARN_ONCE inside
damon_new_region() when the module is enabled with uninitialized or
memoryless node addresses.

Link: https://lore.kernel.org/20260629144432.133962-1-sj@kernel.org

> diff --git a/samples/damon/mtier.c b/samples/damon/mtier.c
> index 775838a23d935..dab8fb10b617a 100644
> --- a/samples/damon/mtier.c
> +++ b/samples/damon/mtier.c
> @@ -120,6 +120,8 @@ static struct damon_ctx *damon_sample_mtier_build_ctx(bool promote)
>  		addr.end = promote ? node1_end_addr : node0_end_addr;
>  	}
>  
> +	if (addr.start >= addr.end)
> +		goto free_out;
>  	region = damon_new_region(addr.start, addr.end);
>  	if (!region)
>  		goto free_out;

[Severity: High]
This is a pre-existing issue, but since we are adding parameter validation
here to prevent panics, should we also validate node0_mem_used_bp and
node0_mem_free_bp later in this function?

If a user writes 0 to these sysfs parameters, they are passed directly to
damos_new_quota_goal() as target values:

    quota_goal = damos_new_quota_goal(
            promote ? DAMOS_QUOTA_NODE_MEM_USED_BP :
            DAMOS_QUOTA_NODE_MEM_FREE_BP,
            promote ? node0_mem_used_bp : node0_mem_free_bp);

When kdamond evaluates the quota score, does this zero target_value
cause a divide-by-zero kernel panic in mm/damon/core.c:damos_quota_score()?

    highest_score = max(highest_score,
            goal->current_value * 10000 /
            goal->target_value);

[Severity: Medium]
This is a pre-existing issue, but I noticed a potential resource leak
in the error handling path for the contexts built by this function.

When the contexts are started in damon_sample_mtier_start():

    ctxs[1] = ctx;
    return damon_start(ctxs, 2, true);

If another exclusive DAMON context is already running, damon_start()
can fail and return -EBUSY. Does returning this error directly leave
the newly allocated struct damon_ctx structures leaked, along with
their associated targets, regions, and schemes?

It looks like the same pattern might exist in damon_sample_prcl_start()
and damon_sample_wsse_start(). Should there be cleanup logic when
damon_start() fails?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260721053718.177006-1-sj@kernel.org?part=1