Re: [RFC PATCH 03/27] mm/damon/core: introduce damon_submit_report()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential
issues to consider:
- [High] mm/damon/core: out-of-bounds write in damon_submit_report() on
  queue wrap
- [Low] mm/damon/core: missing Return section in damon_submit_report()
  kernel-doc
--

commit bcb278386fb51304d0c224892db9744bf9e27c8f
Author: SJ Park <sj@kernel.org>

mm/damon/core: introduce damon_submit_report()

This commit adds damon_submit_report() to enqueue a data attribute report
into the DAMON internal report queue using CAS-based try-locking.

> diff --git a/mm/damon/core.c b/mm/damon/core.c
> index 3f87a7eec442e..06b85d00e38d9 100644
> --- a/mm/damon/core.c
> +++ b/mm/damon/core.c
> @@ -2353,6 +2353,36 @@ struct damon_report_queue {
>  
>  struct damon_report_queue damon_report_queue;
>  
> +/**
> + * damon_submit_report() - Enqueue a given report to DAMON internal buffer.
> + * @report:	The report to enqueue.
> + *
> + * This function can be called from any context including the NMI context.
> + */
> +int damon_submit_report(struct damon_report *report)

[Severity: Low]
This isn't a bug, but the kernel-doc comment for damon_submit_report() is
missing a Return: section describing the 0 and -EBUSY return values, which
triggers a kernel-doc warning under W=2 builds.

> +{
> +	struct damon_report_queue *queue;
> +	int lock_old_val;
> +	unsigned int tail;
> +
> +	queue = &damon_report_queue;
> +	report->jiffies = jiffies;
> +	lock_old_val = atomic_cmpxchg(&queue->lock, 0, 1);
> +	if (lock_old_val)
> +		return -EBUSY;
> +
> +	tail = queue->tail;
> +	if (tail == queue->size)
> +		tail = 0;
> +	queue->reports[tail] = *report;
> +	queue->tail++;

[Severity: High]
Does this write out of bounds of queue->reports[] after the queue wraps?

When queue->tail reaches queue->size, only the local variable tail is
reset to 0 while queue->tail++ increments queue->tail to queue->size + 1.
Every subsequent submission then bypasses the tail == queue->size check
and writes past the end of the queue->reports heap array, corrupting
adjacent slab memory.  Updating queue->tail = tail + 1 would wrap the
index properly.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261115202849.99134-1-sj@kernel.org?part=3