--- /dev/null
+From 954157679ec34661c2e87e7eb796104a797c32db Mon Sep 17 00:00:00 2001
+From: SJ Park <sj@kernel.org>
+Date: Fri, 3 Jul 2026 09:56:08 -0700
+Subject: mm/damon/core: disallow overlapping input ranges for damon_set_regions()
+
+From: SJ Park <sj@kernel.org>
+
+commit 954157679ec34661c2e87e7eb796104a797c32db upstream.
+
+damon_set_regions() assumes the input ranges are sorted by the address and
+don't overlap each other. Hence the assumption was initially to be
+explicitly validated. But commit 97d482f4592f ("mm/damon/sysfs: reuse
+damon_set_regions() for regions setting") has mistakenly removed the
+validation.
+
+This can make DAMON behave in unexpected ways. At the best, the
+monitoring results snapshot will just look weird since there will be
+overlapping regions. DAMOS will also work weirdly, applying the same
+action multiple times for overlapping regions, and make DAMOS quota weird.
+More seriously, depending on the setup and regions updates sequence,
+negative size regions can be made. It will trigger WARN_ONCE() if the
+kernel is built with CONFIG_DAMON_DEBUG_SANITY=y. Depending on the
+monitoring results, the negative size region can further trigger division
+by zero in damon_merge_two_regions().
+
+Note that some of the consequences including the WARN_ONCE() and the
+divide by zero depend on commits that were introduced after the root cause
+commit 97d482f4592f ("mm/damon/sysfs: reuse damon_set_regions() for
+regions setting").
+
+Fix the problems by checking the assumption and returning an error if
+the input ranges don't meet the assumption.
+
+The issue was discovered [1] by Sashiko.
+
+Link: https://lore.kernel.org/20260703165610.92894-1-sj@kernel.org
+Link: https://lore.kernel.org/20260630041806.151124-1-sj@kernel.org [1]
+Fixes: 97d482f4592f ("mm/damon/sysfs: reuse damon_set_regions() for regions setting")
+Signed-off-by: SJ Park <sj@kernel.org>
+Cc: <stable@vger.kernel.org> # 5.19.x
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/damon/core.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/mm/damon/core.c
++++ b/mm/damon/core.c
+@@ -212,12 +212,19 @@ int damon_set_regions(struct damon_targe
+ {
+ struct damon_region *r, *next;
+ unsigned int i;
++ unsigned long last_end;
+ int err;
+
+ for (i = 0; i < nr_ranges; i++) {
+- if (ALIGN_DOWN(ranges[i].start, DAMON_MIN_REGION) >=
+- ALIGN(ranges[i].end, DAMON_MIN_REGION))
++ unsigned long start, end;
++
++ start = ALIGN_DOWN(ranges[i].start, DAMON_MIN_REGION);
++ end = ALIGN(ranges[i].end, DAMON_MIN_REGION);
++ if (start >= end)
++ return -EINVAL;
++ if (i > 0 && last_end > start)
+ return -EINVAL;
++ last_end = end;
+ }
+
+ /* Remove regions which are not in the new ranges */
--- /dev/null
+From 1292c0ecb1caefb8ca064a3639d5673991e8810c Mon Sep 17 00:00:00 2001
+From: SJ Park <sj@kernel.org>
+Date: Mon, 29 Jun 2026 20:52:19 -0700
+Subject: mm/damon/core: validate ranges in damon_set_regions()
+
+From: SJ Park <sj@kernel.org>
+
+commit 1292c0ecb1caefb8ca064a3639d5673991e8810c upstream.
+
+DAMON core logic assumes zero length regions don't exist. However, a few
+DAMON API callers including DAMON_SYSFS, DAMON_RECLAIM and DAMON_LRU_SORT
+allow users to set empty monitoring target regions. This could result in
+WARN_ONCE() on CONFIG_DAMON_DEBUG_SANITY enabled kernel, and
+divide-by-zero from damon_merge_two_regions().
+
+For example, the WANR_ONCE() can be triggered like below.
+
+ # grep DAMON_DEBUG_SANITY /boot/config-$(uname -r)
+ # CONFIG_DAMON_DEBUG_SANITY=y
+ # damo start
+ # cd /sys/kernel/mm/damon/admin/kdamonds/0
+ # echo 0 > contexts/0/targets/0/regions/0/start
+ # echo 0 > contexts/0/targets/0/regions/0/end
+ # echo commit > state
+ # dmesg
+ [....]
+ [ 73.705780] ------------[ cut here ]------------
+ [ 73.707552] start 0 >= end 0
+ [ 73.708452] WARNING: mm/damon/core.c:359 at damon_new_region+0x6e/0x80, CPU#1: kdamond.0/758
+ [...]
+
+All DAMON API callers eventually use damon_set_regions() to setup the
+regions. Add the validation logic in the function.
+
+Link: https://lore.kernel.org/20260630035221.146458-1-sj@kernel.org
+Fixes: 43b0536cb471 ("mm/damon: introduce DAMON-based Reclamation (DAMON_RECLAIM)")
+Signed-off-by: SJ Park <sj@kernel.org>
+Cc: Yang yingliang <yangyingliang@huawei.com>
+Cc: <stable@vger.kernel.org> # 5.16.x
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/damon/core.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/mm/damon/core.c
++++ b/mm/damon/core.c
+@@ -214,6 +214,12 @@ int damon_set_regions(struct damon_targe
+ unsigned int i;
+ int err;
+
++ for (i = 0; i < nr_ranges; i++) {
++ if (ALIGN_DOWN(ranges[i].start, DAMON_MIN_REGION) >=
++ ALIGN(ranges[i].end, DAMON_MIN_REGION))
++ return -EINVAL;
++ }
++
+ /* Remove regions which are not in the new ranges */
+ damon_for_each_region_safe(r, next, t) {
+ for (i = 0; i < nr_ranges; i++) {
--- /dev/null
+From 608045a91d9176d66b2114d0006bc8b57dff2ca9 Mon Sep 17 00:00:00 2001
+From: Miguel Ojeda <ojeda@kernel.org>
+Date: Mon, 15 Jun 2026 16:32:25 +0200
+Subject: rust: allow `suspicious_runtime_symbol_definitions` lint for Rust >= 1.98
+
+From: Miguel Ojeda <ojeda@kernel.org>
+
+commit 608045a91d9176d66b2114d0006bc8b57dff2ca9 upstream.
+
+Starting with Rust 1.98.0 (expected 2026-08-20), Rust is introducing a
+couple new lints, `invalid_runtime_symbol_definitions` (deny-by-default)
+and `suspicious_runtime_symbol_definitions` (warn-by-default), which check
+the signature of items whose symbol name is a runtime symbol expected by
+`core`.
+
+Our build hits the second one, i.e. the warning:
+
+ error: suspicious definition of the runtime `strlen` symbol used by the standard library
+ --> rust/bindings/bindings_generated.rs:20018:5
+ |
+ 20018 | pub fn strlen(s: *const ffi::c_char) -> usize;
+ | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+ |
+ = note: expected `unsafe extern "C" fn(*const i8) -> usize`
+ found `unsafe extern "C" fn(*const u8) -> usize`
+ = help: either fix the signature or remove any attributes like `#[unsafe(no_mangle)]`, `#[unsafe(export_name = "strlen")]`, or `#[link_name = "strlen"]`
+ = help: allow this lint if the signature is compatible
+ = note: `-D suspicious-runtime-symbol-definitions` implied by `-D warnings`
+ = help: to override `-D warnings` add `#[allow(suspicious_runtime_symbol_definitions)]`
+
+ error: suspicious definition of the runtime `strlen` symbol used by the standard library
+ --> rust/uapi/uapi_generated.rs:14236:5
+ |
+ 14236 | pub fn strlen(s: *const ffi::c_char) -> usize;
+ | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+ |
+ = note: expected `unsafe extern "C" fn(*const i8) -> usize`
+ found `unsafe extern "C" fn(*const u8) -> usize`
+ = help: either fix the signature or remove any attributes like `#[unsafe(no_mangle)]`, `#[unsafe(export_name = "strlen")]`, or `#[link_name = "strlen"]`
+ = help: allow this lint if the signature is compatible
+ = note: `-D suspicious-runtime-symbol-definitions` implied by `-D warnings`
+ = help: to override `-D warnings` add `#[allow(suspicious_runtime_symbol_definitions)]`
+
+Thus `allow` the lint in `bindings` and `uapi`.
+
+A more targeted alternative to avoid `allow`ing it would be to pass
+`--blocklist-function strlen` to `bindgen`, but we would perhaps need
+to adjust if other C headers end up adding more (or Rust checking more).
+Since it is just the less critical one that we hit, and since eventually
+this should be properly fixed by getting upstream Rust to provide a flag
+like GCC/Clang's `-funsigned-char` [2][3], just `allow` it for now.
+
+Cc: Urgau <urgau@numericable.fr>
+Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs).
+Link: https://github.com/rust-lang/rust/pull/155521 [1]
+Link: https://github.com/rust-lang/rust/issues/138446 [2]
+Link: https://github.com/Rust-for-Linux/linux/issues/355 [3]
+Reviewed-by: Gary Guo <gary@garyguo.net>
+Reviewed-by: Alice Ryhl <aliceryhl@google.com>
+Reviewed-by: Tamir Duberstein <tamird@kernel.org>
+Link: https://patch.msgid.link/20260615143225.471756-1-ojeda@kernel.org
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ init/Kconfig | 3 +++
+ rust/bindings/lib.rs | 4 ++++
+ rust/uapi/lib.rs | 4 ++++
+ 3 files changed, 11 insertions(+)
+
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -140,6 +140,9 @@ config LD_CAN_USE_KEEP_IN_OVERLAY
+ config RUSTC_HAS_UNNECESSARY_TRANSMUTES
+ def_bool RUSTC_VERSION >= 108800
+
++config RUSTC_HAS_SUSPICIOUS_RUNTIME_SYMBOL_DEFINITIONS
++ def_bool RUSTC_VERSION >= 109800
++
+ config PAHOLE_VERSION
+ int
+ default $(shell,$(srctree)/scripts/pahole-version.sh $(PAHOLE))
+--- a/rust/bindings/lib.rs
++++ b/rust/bindings/lib.rs
+@@ -27,6 +27,10 @@
+ #[allow(dead_code)]
+ #[allow(clippy::undocumented_unsafe_blocks)]
+ #[cfg_attr(CONFIG_RUSTC_HAS_UNNECESSARY_TRANSMUTES, allow(unnecessary_transmutes))]
++#[cfg_attr(
++ CONFIG_RUSTC_HAS_SUSPICIOUS_RUNTIME_SYMBOL_DEFINITIONS,
++ allow(suspicious_runtime_symbol_definitions)
++)]
+ mod bindings_raw {
+ // Manual definition for blocklisted types.
+ type __kernel_size_t = usize;
+--- a/rust/uapi/lib.rs
++++ b/rust/uapi/lib.rs
+@@ -25,6 +25,10 @@
+ unsafe_op_in_unsafe_fn
+ )]
+ #![cfg_attr(CONFIG_RUSTC_HAS_UNNECESSARY_TRANSMUTES, allow(unnecessary_transmutes))]
++#![cfg_attr(
++ CONFIG_RUSTC_HAS_SUSPICIOUS_RUNTIME_SYMBOL_DEFINITIONS,
++ allow(suspicious_runtime_symbol_definitions)
++)]
+
+ // Manual definition of blocklisted types.
+ type __kernel_size_t = usize;
io_uring-rw-fix-missing-erestartsys-conversion-in-re.patch
net-pcs-xpcs-fix-sgmii-state-reading.patch
gve-fix-rx-queue-stall-on-alloc-failure.patch
+rust-allow-suspicious_runtime_symbol_definitions-lint-for-rust-1.98.patch
+mm-damon-core-validate-ranges-in-damon_set_regions.patch
+mm-damon-core-disallow-overlapping-input-ranges-for-damon_set_regions.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
