mm/damon/core: handle region split failure in apply_min_nr_regions()
Subsystems (3)
SJ Park
maintainerRFC PATCH 1/1 mm/damon/core: handle region split failure in apply_min_nr_regions()
damon_apply_min_nr_regions() repeatedly split each region until its size becomes small enough to meet the user-defined low limit of the number of regions. The loop assumes the split operation (damon_split_region_at()) will always succeed and create the new region. But the operation could silently fail for memory allocation failures, for example. If such failure happens and the region was the last region, the linked list-based next region fetching returns invalid pointer. As a result, invalid memory dereference and corruption could happen. Fix by breaking the loop in the corner case.
The allocation failure is unlikely since it is arguably too small to fail. But, it could still theoretically happen, and the consequence is very bad.
This issue was discovered [1] by Sashiko.
[1] https://lore.kernel.org/[email protected]
--- mm/damon/core.c | 3 +++ 1 file changed, 3 insertions(+)
mm/damon/core.c +3 -0
@@ -1912,6 +1912,9 @@ static unsigned long damon_apply_min_nr_regions(struct damon_ctx *ctx)damon_for_each_region_safe (r, next, t) {while (damon_sz_region (r) > max_region_sz) {damon_split_region_at (t, r, max_region_sz); +/* split might failed */ +if (r ==damon_last_region (t)) +break ; r =damon_next_region (r); } }
base-commit: 47263730d8de68a42ac020f8fcb9044f8c86e1b6
Signature · 1 line
2.47.3
SJ Park
maintainerQuoted 9 lines · On Fri, 17 Jul 2026 17:43:00 -0700 SJ Park <[email protected]> wrote:
damon_apply_min_nr_regions()repeatedly split each region until its size becomes small enough to meet the user-defined low limit of the number of regions. The loop assumes the split operation (damon_split_region_at()) will always succeed and create the new region. But the operation could silently fail for memory allocation failures, for example. If such failure happens and the region was the last region, the linked list-based next region fetching returns invalid pointer. As a result, invalid memory dereference and corruption could happen. Fix by breaking the loop in the corner case.
Sashiko found no blocker for this series. Sashiko sent findings to damon@ mailing list [1], and I replied to all the comments. Please read those for details.
[1] https://lore.kernel.org/damon/
Thanks,
SJ
[...]
SJ Park
maintainerQuoted 12 lines · On Fri, 17 Jul 2026 18:03:12 -0700 SJ Park <[email protected]> wrote:
Quoted 9 lines · On Fri, 17 Jul 2026 17:43:00 -0700 SJ Park <[email protected]> wrote:
damon_apply_min_nr_regions()repeatedly split each region until its size becomes small enough to meet the user-defined low limit of the number of regions. The loop assumes the split operation (damon_split_region_at()) will always succeed and create the new region. But the operation could silently fail for memory allocation failures, for example. If such failure happens and the region was the last region, the linked list-based next region fetching returns invalid pointer. As a result, invalid memory dereference and corruption could happen. Fix by breaking the loop in the corner case.
Quoted 3 lines
Sashiko found no blocker for this series. Sashiko sent findings to damon@ mailing list [1], and I replied to all the comments. Please read those for details.
My intention was to add this reply to other mail[1] but I only mistakenly replied here.
This is true, though. Sashiko found no issue in this patch. But that means nothing since this is an RFC. I will repost this patch after dropping the RFC and rebasing to latest mm-new, tomorrow.
[1] https://lore.kernel.org/[email protected]
Quoted 2 lines
Thanks,
SJ
[...]