[PATCH] mm/damon/core: reset nr_dests on allocation failure in damos_commit_dests()

Josh Law
2026-03-18T21:50:07Z

damos_commit_dests() frees the old node_id_arr and weight_arr before
reallocating. If kmalloc_array() fails, the function returns -ENOMEM but
leaves dst->nr_dests at its previous value. A subsequent call with the
same nr_dests will skip the reallocation (the sizes match), and the loop
at the end will dereference the now-NULL array pointers.

Fix this by resetting dst->nr_dests to 0 immediately after freeing the
old arrays, so any later call always enters the reallocation path.

Fixes: cbc4eea4ffb5 ("mm/damon/core: commit damos->migrate_dests")
Signed-off-by: Josh Law <objecting@objecting.org>
---
mm/damon/core.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/mm/damon/core.c b/mm/damon/core.c
index 7f74982535ac..e233eb84a2d5 100644
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -1060,6 +1060,7 @@ static int damos_commit_dests(struct damos_migrate_dests *dst,
if (dst->nr_dests != src->nr_dests) {
kfree(dst->node_id_arr);
kfree(dst->weight_arr);
+ dst->nr_dests = 0;

dst->node_id_arr = kmalloc_array(src->nr_dests,
sizeof(*dst->node_id_arr), GFP_KERNEL);
--
2.34.1