Re: [RFC PATCH 3/8] mm/damon/ops-common: support hugepage_size damon filter matching

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] damon_commit_filters() leaves range_min and range_max uninitialized for appended hugepage_size filters.
--

commit 377608c283881250a794879309e80b931825b0d3
Author: SJ Park <sj@kernel.org>

mm/damon/ops-common: support hugepage_size damon filter matching

Update ops-common data attribute filter matching logic to support
hugepage_size filter type.

> diff --git a/mm/damon/ops-common.c b/mm/damon/ops-common.c
> index c36cc39cd2c70..77366f42b3e5b 100644
> --- a/mm/damon/ops-common.c
> +++ b/mm/damon/ops-common.c

[ ... ]

> @@ -558,6 +559,15 @@ bool damon_ops_filter_match(struct damon_filter *filter, struct folio *folio)
>  			matched = filter->memcg_id == mem_cgroup_id(memcg);
>  		rcu_read_unlock();
>  		break;
> +	case DAMON_FILTER_TYPE_HUGEPAGE_SIZE:
> +		if (!folio) {
> +			matched = false;
> +			break;
> +		}
> +		folio_sz = folio_size(folio);
> +		matched = filter->range_min <= folio_sz &&
> +			folio_sz <= filter->range_max;
> +		break;

[Severity: High]
Does this new filter type need to be explicitly copied when a newly appended
filter is committed?

When userspace adds a new filter to an existing DAMON probe via sysfs,
damon_commit_filters() in mm/damon/core.c invokes damon_new_filter() which
allocates memory without zeroing it. The attributes are then copied in a
switch block:

mm/damon/core.c:damon_commit_filters() {
	...
	new_filter = damon_new_filter(src_filter->type,
			src_filter->matching, src_filter->allow);
	if (!new_filter)
		return -ENOMEM;
	switch (src_filter->type) {
	case DAMON_FILTER_TYPE_MEMCG:
		new_filter->memcg_id = src_filter->memcg_id;
		break;
	default:
		break;
	}
	damon_add_filter(dst, new_filter);
	...
}

Because DAMON_FILTER_TYPE_HUGEPAGE_SIZE is missing from this switch block,
range_min and range_max will be left uninitialized for appended filters. This
could result in the filtering logic using garbage memory values.

Should DAMON_FILTER_TYPE_HUGEPAGE_SIZE be added to this switch statement
so the range boundaries are properly copied to the new filter?

>  	default:
>  		break;
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260913171133.102366-1-sj@kernel.org?part=3