Re: [RFC PATCH v1.2 05/12] mm/damon/sysfs: remove probes number validation

On Wed, 29 Jul 2026 14:16:24 +0000 [email protected] wrote:

> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] Removing the upper bound check on `nr_probes` allows userspace to trigger massive unbounded kobject allocations, causing soft lockups and OOM.
> --
> 
> --- Patch [5]: [RFC PATCH v1.2 05/12] mm/damon/sysfs: remove probes number validation ---
> commit a336beb0d20022011c91edc1b40bfb3902ced157
> Author: SJ Park <[email protected]>
> 
> mm/damon/sysfs: remove probes number validation
> 
> DAMON sysfs interface drops the >DAMON_MAX_PROBES validation on
> nr_probes input, intending to let the core layer validate the upper
> limit instead.
> 
> > diff --git a/mm/damon/sysfs.c b/mm/damon/sysfs.c
> > index e3858ffab4b22..85dca07169c63 100644
> > --- a/mm/damon/sysfs.c
> > +++ b/mm/damon/sysfs.c
> > @@ -1234,7 +1234,7 @@ static ssize_t nr_probes_store(struct kobject *kobj,
> >  
> >  	if (err)
> >  		return err;
> > -	if (nr < 0 || nr > DAMON_MAX_PROBES)
> > +	if (nr < 0)
> >  		return -EINVAL;
> 
> [Severity: High]
> Does removing this upper bound allow userspace to trigger soft lockups or
> OOM?
> 
> If a user writes a very large value (e.g. 2,000,000) here, that unbounded
> value is passed into damon_sysfs_probes_add_dirs() and iterates this loop:
> 
> mm/damon/sysfs.c:damon_sysfs_probes_add_dirs() {
>     ...
> 	probes_arr = kmalloc_objs(*probes_arr, nr_probes,
> 				   GFP_KERNEL | __GFP_NOWARN);
> 	if (!probes_arr)
> 		return -ENOMEM;
> 	probes->probes_arr = probes_arr;
> 
> 	for (i = 0; i < nr_probes; i++) {
> 		probe = damon_sysfs_probe_alloc();
>     ...
> }
> 
> Since this loop allocates sysfs kobjects synchronously without
> cond_resched(), will this cause the system to freeze or exhaust memory
> before the DAMON core layer ever gets a chance to validate the parameters?

Sane users wouldn't do that.  We can revisit if this turns out to be a real
issue.

> 
> >  
> >  	probes = container_of(kobj, struct damon_sysfs_probes, kobj);
> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=5


Thanks,
SJ