Re: [RFC PATCH v2 5/8] mm/damon/sysfs: support hugepage_size probe filter

[SJ Park <sj@kernel.org>]

On Mon, 14 Sep 2026 14:54:03 +0000 sashiko-bot@kernel.org wrote:

> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] Missing range validation for hugepage_size filters in sysfs allows triggering a memory leak in the DAMON core.
> --
> 
> commit 2e8e2509774f21f3f602056d79fd21880b487fde
> Author: SJ Park <sj@kernel.org>
> 
> mm/damon/sysfs: support hugepage_size probe filter
> 
> Extend DAMON sysfs interface to support hugepage_size probe filter. Allows
> hugepage_size user string input to the filter type file and passes the size
> range argument via min/max files to the DAMON core.
> 
> > diff --git a/mm/damon/sysfs.c b/mm/damon/sysfs.c
> > index 8e8d89b8ed981..43519afb9eb7f 100644
> > --- a/mm/damon/sysfs.c
> > +++ b/mm/damon/sysfs.c
> [ ... ]
> > @@ -2273,6 +2277,9 @@ static int damon_sysfs_set_filters(struct damon_probe *probe,
> >  				damon_destroy_filter(filter);
> >  				return err;
> >  			}
> > +		} else if (filter->type == DAMON_FILTER_TYPE_HUGEPAGE_SIZE) {
> > +			filter->range_min = sys_filter->range_min;
> > +			filter->range_max = sys_filter->range_max;
> >  		}
> >  		damon_add_filter(probe, filter);
> >  	}
> 
> [Severity: High]
> Does this code need validation to ensure sys_filter->range_min <=
> sys_filter->range_max before passing the values to the DAMON core?
> 
> If a local user configures a filter with a minimum value greater than the
> maximum value, this unvalidated input will reach damon_commit_filters() in
> mm/damon/core.c.
> 
> In damon_commit_filters(), the core detects the invalid range but returns
> -EINVAL directly:
> 
> mm/damon/core.c:damon_commit_filters() {
> 	...
> 	case DAMON_FILTER_TYPE_HUGEPAGE_SIZE:
> 		if (src_filter->range_max < src_filter->range_min)
> 			return -EINVAL;
> 		new_filter->range_min = src_filter->range_min;
> 		new_filter->range_max = src_filter->range_max;
> 		break;
> 	...
> }
> 
> Returning directly bypasses damon_destroy_filter(), which leaves the newly
> allocated new_filter orphaned. Because a local user with sysfs access can
> repeatedly trigger this by writing invalid ranges and committing the state,
> could this lead to a memory leak and potential memory exhaustion?

I will fix the leak in the next spin.

> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20260914144448.93732-1-sj@kernel.org?part=5


Thanks,
SJ