Re: [RFC PATCH 5/8] mm/damon/sysfs-schemes: drop centralized filter range arg validations

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Removing the filter range argument validation in `damon_sysfs_add_scheme_filters()` relies on the core layer to perform this validation. However, the core layer's commit functions (`damos_commit_core_filters()` and `damos_commit_ops_filters()`) silently ignore the return value of `damos_commit_filter_arg()` when adding new filters. When an invalid range is provided via sysfs, `damos_commit_filter_arg()` returns `-EINVAL` and aborts before copying the arguments. Because `damos_new_filter()` uses `kmalloc_obj()` (which does not zero memory), the new filter's union arguments (e.g., `addr_range`) are left completely uninitialized. The filter is then added to the active DAMON context, resulting in the scheme acting on an unpredictable memory range derived from uninitialized heap garbage.
--

commit a45f05608fa3c7f9050ea4eac0fd8f19b22ee509
Author: SJ Park <sj@kernel.org>

mm/damon/sysfs-schemes: drop centralized filter range arg validations

This patch drops the centralized filter range argument validations in the
DAMON sysfs interface, relying on the core layer to perform this validation.

> diff --git a/mm/damon/sysfs-schemes.c b/mm/damon/sysfs-schemes.c
> index 8c8ab82c8facc..a4ec5d54cfbd1 100644
> --- a/mm/damon/sysfs-schemes.c
> +++ b/mm/damon/sysfs-schemes.c

[ ... ]

> @@ -2832,27 +2832,14 @@ static int damon_sysfs_add_scheme_filters(struct damos *scheme,
>  			}
>  		} else if (filter->type == DAMOS_FILTER_TYPE_ADDR) {
>  			filter->addr_range = sysfs_filter->addr_range;
> -			if (filter->addr_range.end <
> -					filter->addr_range.start) {
> -				damos_destroy_filter(filter);
> -				return -EINVAL;
> -			}
>  		} else if (filter->type == DAMOS_FILTER_TYPE_TARGET) {
>  			filter->target_idx = sysfs_filter->target_idx;
>  		} else if (filter->type == DAMOS_FILTER_TYPE_HUGEPAGE_SIZE) {
>  			filter->sz_range.min = sysfs_filter->range_min;
>  			filter->sz_range.max = sysfs_filter->range_max;
> -			if (filter->range_min > filter->range_max) {
> -				damos_destroy_filter(filter);
> -				return -EINVAL;
> -			}

[Severity: High]
Does removing this validation allow invalid ranges to bypass sysfs and reach
the core layer logic where errors are silently ignored?

Looking at damos_commit_core_filters() in mm/damon/core.c, the return value
of damos_commit_filter_arg() is not checked when adding new filters:

mm/damon/core.c:damos_commit_core_filters() {
    ...
    damos_commit_filter_arg(new_filter, src_filter);
    damos_add_filter(dst, new_filter);
    ...
}

A similar pattern exists for ops filters in damos_commit_ops_filters():

mm/damon/core.c:damos_commit_ops_filters() {
    ...
    if (src_filter)
        damos_commit_filter(dst_filter, src_filter);
    ...
    damos_commit_filter_arg(new_filter, src_filter);
    damos_add_filter(dst, new_filter);
    ...
}

When an invalid range is provided via sysfs, damos_commit_filter_arg()
returns -EINVAL and aborts before copying the arguments. Because the new
filter is allocated without zeroing its memory, the filter's union arguments
(like addr_range) are left completely uninitialized.

Since the error is ignored and damos_add_filter() is still called, won't
this result in the scheme acting on an unpredictable memory range derived
from uninitialized heap garbage?

>  		} else if (filter->type == DAMOS_FILTER_TYPE_PROBE_HITS_WSUM) {
>  			filter->range_min = sysfs_filter->range_min;
>  			filter->range_max = sysfs_filter->range_max;
> -			if (filter->range_min > filter->range_max) {
> -				damos_destroy_filter(filter);
> -				return -EINVAL;
> -			}
>  		}
>  
>  		damos_add_filter(scheme, filter);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260912191807.138502-1-sj@kernel.org?part=5