Re: [RFC PATCH v1.2 05/12] mm/damon/sysfs: remove probes number validation

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Removing the upper bound check on `nr_probes` allows userspace to trigger massive unbounded kobject allocations, causing soft lockups and OOM.
--

--- Patch [5]: [RFC PATCH v1.2 05/12] mm/damon/sysfs: remove probes number validation ---
commit a336beb0d20022011c91edc1b40bfb3902ced157
Author: SJ Park <sj@kernel.org>

mm/damon/sysfs: remove probes number validation

DAMON sysfs interface drops the >DAMON_MAX_PROBES validation on
nr_probes input, intending to let the core layer validate the upper
limit instead.

> diff --git a/mm/damon/sysfs.c b/mm/damon/sysfs.c
> index e3858ffab4b22..85dca07169c63 100644
> --- a/mm/damon/sysfs.c
> +++ b/mm/damon/sysfs.c
> @@ -1234,7 +1234,7 @@ static ssize_t nr_probes_store(struct kobject *kobj,
>  
>  	if (err)
>  		return err;
> -	if (nr < 0 || nr > DAMON_MAX_PROBES)
> +	if (nr < 0)
>  		return -EINVAL;

[Severity: High]
Does removing this upper bound allow userspace to trigger soft lockups or
OOM?

If a user writes a very large value (e.g. 2,000,000) here, that unbounded
value is passed into damon_sysfs_probes_add_dirs() and iterates this loop:

mm/damon/sysfs.c:damon_sysfs_probes_add_dirs() {
    ...
	probes_arr = kmalloc_objs(*probes_arr, nr_probes,
				   GFP_KERNEL | __GFP_NOWARN);
	if (!probes_arr)
		return -ENOMEM;
	probes->probes_arr = probes_arr;

	for (i = 0; i < nr_probes; i++) {
		probe = damon_sysfs_probe_alloc();
    ...
}

Since this loop allocates sysfs kobjects synchronously without
cond_resched(), will this cause the system to freeze or exhaust memory
before the DAMON core layer ever gets a chance to validate the parameters?

>  
>  	probes = container_of(kobj, struct damon_sysfs_probes, kobj);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260729140253.87753-1-sj@kernel.org?part=5