Re: [RFC PATCH 2/8] mm/damon/core: commit hugepage_size type damon filter

[SJ Park <sj@kernel.org>]

On Sun, 13 Sep 2026 10:33:22 -0700 SJ Park <sj@kernel.org> wrote:

> On Sun, 13 Sep 2026 17:24:21 +0000 sashiko-bot@kernel.org wrote:
> 
> > Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> > - [High] Missing initialization and validation of `range_min` and `range_max` for newly appended `hugepage_size` filters leads to uninitialized memory usage.
> > --
> > 
> > commit 2b0a5f30b2fda9db59b511fc77d64fcbd35378ca
> > Author: SJ Park <sj@kernel.org>
> > 
> > mm/damon/core: commit hugepage_size type damon filter
> > 
> > Extend data attribute probe filters commit logic for the new
> > hugepage_size filter type.  Since it needs to carry the size range of
> > the hugepage, update the logic to update the size range fields of the
> > commit destination filter struct.
> > 
> > > diff --git a/mm/damon/core.c b/mm/damon/core.c
> > > index 0c98f7e267d07..a3febdc355c1e 100644
> > > --- a/mm/damon/core.c
> > > +++ b/mm/damon/core.c
> > 
> > [ ... ]
> > 
> > > @@ -1807,23 +1807,33 @@ static void damon_commit_filter(struct damon_filter *dst,
> > >  	case DAMON_FILTER_TYPE_MEMCG:
> > >  		dst->memcg_id = src->memcg_id;
> > >  		break;
> > > +	case DAMON_FILTER_TYPE_HUGEPAGE_SIZE:
> > > +		if (src->range_max < src->range_min)
> > > +			return -EINVAL;
> > > +		dst->range_min = src->range_min;
> > > +		dst->range_max = src->range_max;
> > > +		break;
> > >  	default:
> > >  		break;
> > >  	}
> > > +	return 0;
> > >  }
> > >  
> > >  static int damon_commit_filters(struct damon_probe *dst,
> > >  		struct damon_probe *src)
> > >  {
> > 
> > [ ... ]
> > 
> > >  	damon_for_each_filter_safe(src_filter, next, src) {
> > >  		if (j++ < i)
> > >  			continue;
> > >  
> > >  		new_filter = damon_new_filter(src_filter->type,
> > >  				src_filter->matching, src_filter->allow);
> > >  		if (!new_filter)
> > >  			return -ENOMEM;
> > >  		switch (src_filter->type) {
> > >  		case DAMON_FILTER_TYPE_MEMCG:
> > >  			new_filter->memcg_id = src_filter->memcg_id;
> > >  			break;
> > >  		default:
> > >  			break;
> > >  		}
> > >  		damon_add_filter(dst, new_filter);
> > 
> > [Severity: High]
> > Does this code leave range_min and range_max uninitialized for newly
> > appended hugepage_size filters?
> > 
> > If a user writes a new hugepage_size filter to a running probe via sysfs,
> > it triggers the filter appending path here:
> > damon_commit_ctx() -> damon_commit_probes() -> damon_commit_filters()
> > 
> > When the new filter is appended, damon_new_filter() allocates memory with
> > kmalloc(), which does not zero-initialize the memory. The switch statement
> > then omits copying range_min and range_max for
> > DAMON_FILTER_TYPE_HUGEPAGE_SIZE, leaving them as uninitialized heap garbage.
> > 
> > This makes the hugepage_size filter unpredictable and could cause incorrect
> > memory pages to be filtered in or out. It also completely bypasses the
> > validation logic added for existing filters in damon_commit_filter().
> 
> DAMON sysfs is not allowing hugepage_size filter at the moment, so this issue
> cannot happen.  A later patch of this series will add the support with correct
> range setup.

I was wrong.  I will fix this in the next spin.

> 
> > 
> > -- 
> > Sashiko AI review · https://sashiko.dev/#/patchset/20260913171133.102366-1-sj@kernel.org?part=2
> 
> 
> Thanks,
> SJ
> 


Thanks,
SJ