Re: + mm-damon-core-validate-damos_quota_goal-nid-for-node_mem_usedfree_bp.patch added to mm-hotfixes-unstable branch

[SeongJae Park <sj@kernel.org>]

Hello Andrew,

On Tue, 31 Mar 2026 20:31:51 -0700 Andrew Morton <akpm@linux-foundation.org> wrote:

> 
> The patch titled
>      Subject: mm/damon/core: validate damos_quota_goal->nid for node_mem_{used,free}_bp
> has been added to the -mm mm-hotfixes-unstable branch.  Its filename is
>      mm-damon-core-validate-damos_quota_goal-nid-for-node_mem_usedfree_bp.patch
[...]
> ------------------------------------------------------
> From: SeongJae Park <sj@kernel.org>
> Subject: mm/damon/core: validate damos_quota_goal->nid for node_mem_{used,free}_bp
> Date: Sat, 28 Mar 2026 21:38:59 -0700
> 
> Patch series "mm/damon/core: validate damos_quota_goal->nid".
> 
> node_mem[cg]_{used,free}_bp DAMOS quota goals receive the node id.  The
> node id is used for si_meminfo_node() and NODE_DATA() without proper
> validation.  As a result, privileged users can trigger an out of bounds
> memory access using DAMON_SYSFS.  Fix the issues.
> 
> The issue was originally reported [1] with a fix by another author.  The
> original author announced [2] that they will stop working including the
> fix that was still in the review stage.  Hence I'm restarting this.
> 
> 
> Users can set damos_quota_goal->nid with arbitrary value for
> node_mem_{used,free}_bp.  But DAMON core is using those for
> si_meminfo_node() without the validation of the value.  This can result in
> out of bounds memory access.  The issue can actually triggered using DAMON
> user-space tool (damo), like below.

Seems "This patch (of X):" line before the above paragraph is missed.


Thanks,
SJ

[...]