Re: [RFC PATCH v2 5/8] mm/damon/sysfs: support hugepage_size probe filter

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Missing range validation for hugepage_size filters in sysfs allows triggering a memory leak in the DAMON core.
--

commit 2e8e2509774f21f3f602056d79fd21880b487fde
Author: SJ Park <sj@kernel.org>

mm/damon/sysfs: support hugepage_size probe filter

Extend DAMON sysfs interface to support hugepage_size probe filter. Allows
hugepage_size user string input to the filter type file and passes the size
range argument via min/max files to the DAMON core.

> diff --git a/mm/damon/sysfs.c b/mm/damon/sysfs.c
> index 8e8d89b8ed981..43519afb9eb7f 100644
> --- a/mm/damon/sysfs.c
> +++ b/mm/damon/sysfs.c
[ ... ]
> @@ -2273,6 +2277,9 @@ static int damon_sysfs_set_filters(struct damon_probe *probe,
>  				damon_destroy_filter(filter);
>  				return err;
>  			}
> +		} else if (filter->type == DAMON_FILTER_TYPE_HUGEPAGE_SIZE) {
> +			filter->range_min = sys_filter->range_min;
> +			filter->range_max = sys_filter->range_max;
>  		}
>  		damon_add_filter(probe, filter);
>  	}

[Severity: High]
Does this code need validation to ensure sys_filter->range_min <=
sys_filter->range_max before passing the values to the DAMON core?

If a local user configures a filter with a minimum value greater than the
maximum value, this unvalidated input will reach damon_commit_filters() in
mm/damon/core.c.

In damon_commit_filters(), the core detects the invalid range but returns
-EINVAL directly:

mm/damon/core.c:damon_commit_filters() {
	...
	case DAMON_FILTER_TYPE_HUGEPAGE_SIZE:
		if (src_filter->range_max < src_filter->range_min)
			return -EINVAL;
		new_filter->range_min = src_filter->range_min;
		new_filter->range_max = src_filter->range_max;
		break;
	...
}

Returning directly bypasses damon_destroy_filter(), which leaves the newly
allocated new_filter orphaned. Because a local user with sysfs access can
repeatedly trigger this by writing invalid ranges and committing the state,
could this lead to a memory leak and potential memory exhaustion?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260914144448.93732-1-sj@kernel.org?part=5