Re: [PATCH 5/7] mm/damon/sysfs-schemes: support probe_hits_wsum damos core filter

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Time-of-Check to Time-of-Use race when validating probe_hits_wsum range allows invalid filter configurations to bypass validation.
--

commit 27bc99697c36a87c8e4b72fe6006955a564a4bb2
Author: SJ Park <sj@kernel.org>

mm/damon/sysfs-schemes: support probe_hits_wsum damos core filter

Extend DAMON sysfs interface to support probe_hits_wsum input. Also
update sysfs input based scheme build logic to setup the min/max probe
hits weighted sum range as user provided.

> diff --git a/mm/damon/sysfs-schemes.c b/mm/damon/sysfs-schemes.c
> index 4d9147d2a269e..d9dd4ee0442c7 100644
> --- a/mm/damon/sysfs-schemes.c
> +++ b/mm/damon/sysfs-schemes.c

[ ... ]

> @@ -2844,6 +2847,14 @@ static int damon_sysfs_add_scheme_filters(struct damos *scheme,
>  			}
>  			filter->sz_range.min = sysfs_filter->range_min;
>  			filter->sz_range.max = sysfs_filter->range_max;
> +		} else if (filter->type == DAMOS_FILTER_TYPE_PROBE_HITS_WSUM) {
> +			if (sysfs_filter->range_min >
> +					sysfs_filter->range_max) {
> +				damos_destroy_filter(filter);
> +				return -EINVAL;
> +			}
> +			filter->range_min = sysfs_filter->range_min;
> +			filter->range_max = sysfs_filter->range_max;

[Severity: Medium]
Are these repeated reads of sysfs_filter->range_min and sysfs_filter->range_max
susceptible to a time-of-check to time-of-use race?

If a privileged user concurrently writes to a filter's min or max sysfs
attribute between the validation check and the assignments:

    if (sysfs_filter->range_min > sysfs_filter->range_max) {
        // Validation passes
    }

    // Concurrent sysfs write updates range_min here

    filter->range_min = sysfs_filter->range_min; // Now invalid

Could this allow an invalid configuration to bypass the check and be added to
the DAMON scheme? Would it be safer to read the values into local variables
first, validate those local variables, and then assign them to the filter?

>  		}
>  
>  		damos_add_filter(scheme, filter);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260910141849.170896-1-sj@kernel.org?part=5