Re: [RFC PATCH v3 5/8] mm/damon/sysfs: support hugepage_size probe filter

[SJ Park <sj@kernel.org>]

On Tue, 15 Sep 2026 02:24:30 +0000 sashiko-bot@kernel.org wrote:

> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] mm: partial commit failure in damon_commit_filter() causes DAMON context state corruption
> --
> 
> commit bba894847aad85f23c968a2f306ec06c6e1b1a8c
> Author: SJ Park <sj@kernel.org>
> 
> mm/damon/sysfs: support hugepage_size probe filter
>     
> Extend DAMON sysfs interface to support hugepage_size probe filter.
> Allows hugepage_size user string input to the filter type file.  Pass
> the size range argument that users set via min/max files under the probe
> filter directory to the DAMON core.
> 
> > diff --git a/mm/damon/sysfs.c b/mm/damon/sysfs.c
> > index 8e8d89b8ed981..43519afb9eb7f 100644
> > --- a/mm/damon/sysfs.c
> > +++ b/mm/damon/sysfs.c
> [ ... ]
> > @@ -2273,6 +2277,9 @@ static int damon_sysfs_set_filters(struct damon_probe *probe,
> >  				damon_destroy_filter(filter);
> >  				return err;
> >  			}
> > +		} else if (filter->type == DAMON_FILTER_TYPE_HUGEPAGE_SIZE) {
> > +			filter->range_min = sys_filter->range_min;
> > +			filter->range_max = sys_filter->range_max;
> >  		}
> 
> [Severity: High]
> Can an invalid hugepage_size range (where range_min > range_max) cause state
> corruption in the DAMON context?
> 
> When a user configures a hugepage_size filter with range_min > range_max,
> the values are copied blindly here into the intermediate context without
> validation.
> 
> During the subsequent commit, damon_commit_filter() in mm/damon/core.c
> updates the destination filter:
> 
> mm/damon/core.c:damon_commit_filter() {
> 	dst->type = src->type;
> 	dst->matching = src->matching;
> 	dst->allow = src->allow;
> 	switch (dst->type) {
> 	case DAMON_FILTER_TYPE_MEMCG:
> 		dst->memcg_id = src->memcg_id;
> 		break;
> 	case DAMON_FILTER_TYPE_HUGEPAGE_SIZE:
> 		if (src->range_max < src->range_min)
> 			return -EINVAL;
> ...
> }
> 
> Because the validation fails and returns -EINVAL after dst->type,
> dst->matching, and dst->allow have already been updated, the commit aborts
> midway. This leaves the active DAMON context's filter partially mutated,
> interpreting its previous union field (like memcg_id) as the new range
> bounds.
> 
> Could validation be added to damon_sysfs_set_filters() in mm/damon/sysfs.c
> to prevent invalid bounds from reaching the core commit logic?

No issue.  damon_ctx->maybe_corrupted is there to avoid using such corrupted
state.

> 
> >  		damon_add_filter(probe, filter);
> >  	}
> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20260915020929.102953-1-sj@kernel.org?part=5


Thanks,
SJ