Re: [RFC PATCH 1/9] mm/damon/core: skip applying scheme if region split for quota fails

On Sat, 01 Aug 2026 13:02:08 -0700 SJ Park <[email protected]> wrote:

> On Sat, 01 Aug 2026 17:53:34 +0000 [email protected] wrote:
> 
> > Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> > 
> > Pre-existing issues:
> > - [High] Unhandled failure of damon_split_region_at() in damos_filter_match() leads to bypassing or incorrectly applying address filters.
> > --
> > 
> > --- Patch [1]: [RFC PATCH 1/9] mm/damon/core: skip applying scheme if region split for quota fails ---
> > commit 812934b542c69c596afadb66403f8c9c11c5bf91
> > Author: SJ Park <[email protected]>
> > 
> > mm/damon/core: skip applying scheme if region split for quota fails
> > 
> > damos_apply_scheme() splits a region and apply the action to the
> > subregion if it is needed for not violating the quota.  The split
> > operation (damon_split_region_at()) could fail for allocation failure.
> > In the case, the quota could be violated.  From the user's perspective,
> > DAMOS becomes more aggressive than expected under the extreme situation.
> > Handle the failure.
> > 
> > Link: https://lore.kernel.org/[email protected]
> > 
> > > diff --git a/mm/damon/core.c b/mm/damon/core.c
> > > index 644daf5a16560..e2900d0c984c9 100644
> > > --- a/mm/damon/core.c
> > > +++ b/mm/damon/core.c
> > > @@ -2613,7 +2613,8 @@ static void damos_apply_scheme(struct damon_ctx *c, struct damon_target *t,
> > >  					c->min_region_sz);
> > >  			if (!sz)
> > >  				goto update_stat;
> > > -			damon_split_region_at(t, r, sz);
> > > +			if (damon_split_region_at(t, r, sz))
> > > +				goto update_stat;
> > 
> > [Severity: High]
> > This is a pre-existing issue, but since we are handling the failure of
> > damon_split_region_at() here, should we also handle it in
> > damos_filter_match()?
> > 
> > If a memory region partially overlaps a filter range and the split
> > allocation fails in damos_filter_match(), the return value is ignored:
> > 
> > mm/damon/core.c:damos_filter_match() {
> >     ...
> > 		/* start before the range and overlap */
> > 		if (r->ar.start < start) {
> > 			damon_split_region_at(t, r, start - r->ar.start);
> > 			matched = false;
> > 			break;
> > 		}
> > 		/* start inside the range */
> > 		damon_split_region_at(t, r, end - r->ar.start);
> > 		matched = true;
> > 		break;
> >     ...
> > }
> > 
> > If the split fails, the intact region spanning both outside and inside the
> > filter range is unconditionally evaluated as 'matched = false' or
> > 'matched = true', incorrectly bypassing the filter or applying it to unrelated
> > memory outside the intended range.
> > 
> > Could this lead to destructive actions (e.g., PAGEOUT) being applied to
> > explicitly protected memory?
> 
> Nice catch.  I will fix this together.

But, it is unclear what to do in this case.  Maybe it is better to just back
off and cancel the DAMOS action.  And that would be no small change.  I will
work on it separately.

> 
> > 
> > >  		}
> > >  		if (damos_core_filter_out(c, t, r, s))
> > >  			return;
> > 
> > -- 
> > Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1
> 
> 
> Thanks,
> SJ
> 


Thanks,
SJ