--- a/kernel/kexec_handover.c
+++ b/kernel/kexec_handover.c
-@@ -569,20 +569,30 @@ early_param("kho_scratch", kho_parse_scr
+@@ -562,20 +562,30 @@ early_param("kho_scratch", kho_parse_scr
static void __init scratch_size_update(void)
{
--- /dev/null
+From 954157679ec34661c2e87e7eb796104a797c32db Mon Sep 17 00:00:00 2001
+From: SJ Park <sj@kernel.org>
+Date: Fri, 3 Jul 2026 09:56:08 -0700
+Subject: mm/damon/core: disallow overlapping input ranges for damon_set_regions()
+
+From: SJ Park <sj@kernel.org>
+
+commit 954157679ec34661c2e87e7eb796104a797c32db upstream.
+
+damon_set_regions() assumes the input ranges are sorted by the address and
+don't overlap each other. Hence the assumption was initially to be
+explicitly validated. But commit 97d482f4592f ("mm/damon/sysfs: reuse
+damon_set_regions() for regions setting") has mistakenly removed the
+validation.
+
+This can make DAMON behave in unexpected ways. At the best, the
+monitoring results snapshot will just look weird since there will be
+overlapping regions. DAMOS will also work weirdly, applying the same
+action multiple times for overlapping regions, and make DAMOS quota weird.
+More seriously, depending on the setup and regions updates sequence,
+negative size regions can be made. It will trigger WARN_ONCE() if the
+kernel is built with CONFIG_DAMON_DEBUG_SANITY=y. Depending on the
+monitoring results, the negative size region can further trigger division
+by zero in damon_merge_two_regions().
+
+Note that some of the consequences including the WARN_ONCE() and the
+divide by zero depend on commits that were introduced after the root cause
+commit 97d482f4592f ("mm/damon/sysfs: reuse damon_set_regions() for
+regions setting").
+
+Fix the problems by checking the assumption and returning an error if
+the input ranges don't meet the assumption.
+
+The issue was discovered [1] by Sashiko.
+
+Link: https://lore.kernel.org/20260703165610.92894-1-sj@kernel.org
+Link: https://lore.kernel.org/20260630041806.151124-1-sj@kernel.org [1]
+Fixes: 97d482f4592f ("mm/damon/sysfs: reuse damon_set_regions() for regions setting")
+Signed-off-by: SJ Park <sj@kernel.org>
+Cc: <stable@vger.kernel.org> # 5.19.x
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: SJ Park <sj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/damon/core.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/mm/damon/core.c
++++ b/mm/damon/core.c
+@@ -213,12 +213,19 @@ int damon_set_regions(struct damon_targe
+ {
+ struct damon_region *r, *next;
+ unsigned int i;
++ unsigned long last_end;
+ int err;
+
+ for (i = 0; i < nr_ranges; i++) {
+- if (ALIGN_DOWN(ranges[i].start, min_sz_region) >=
+- ALIGN(ranges[i].end, min_sz_region))
++ unsigned long start, end;
++
++ start = ALIGN_DOWN(ranges[i].start, min_sz_region);
++ end = ALIGN(ranges[i].end, min_sz_region);
++ if (start >= end)
++ return -EINVAL;
++ if (i > 0 && last_end > start)
+ return -EINVAL;
++ last_end = end;
+ }
+
+ /* Remove regions which are not in the new ranges */
--- /dev/null
+From 1292c0ecb1caefb8ca064a3639d5673991e8810c Mon Sep 17 00:00:00 2001
+From: SJ Park <sj@kernel.org>
+Date: Mon, 29 Jun 2026 20:52:19 -0700
+Subject: mm/damon/core: validate ranges in damon_set_regions()
+
+From: SJ Park <sj@kernel.org>
+
+commit 1292c0ecb1caefb8ca064a3639d5673991e8810c upstream.
+
+DAMON core logic assumes zero length regions don't exist. However, a few
+DAMON API callers including DAMON_SYSFS, DAMON_RECLAIM and DAMON_LRU_SORT
+allow users to set empty monitoring target regions. This could result in
+WARN_ONCE() on CONFIG_DAMON_DEBUG_SANITY enabled kernel, and
+divide-by-zero from damon_merge_two_regions().
+
+For example, the WANR_ONCE() can be triggered like below.
+
+ # grep DAMON_DEBUG_SANITY /boot/config-$(uname -r)
+ # CONFIG_DAMON_DEBUG_SANITY=y
+ # damo start
+ # cd /sys/kernel/mm/damon/admin/kdamonds/0
+ # echo 0 > contexts/0/targets/0/regions/0/start
+ # echo 0 > contexts/0/targets/0/regions/0/end
+ # echo commit > state
+ # dmesg
+ [....]
+ [ 73.705780] ------------[ cut here ]------------
+ [ 73.707552] start 0 >= end 0
+ [ 73.708452] WARNING: mm/damon/core.c:359 at damon_new_region+0x6e/0x80, CPU#1: kdamond.0/758
+ [...]
+
+All DAMON API callers eventually use damon_set_regions() to setup the
+regions. Add the validation logic in the function.
+
+Link: https://lore.kernel.org/20260630035221.146458-1-sj@kernel.org
+Fixes: 43b0536cb471 ("mm/damon: introduce DAMON-based Reclamation (DAMON_RECLAIM)")
+Signed-off-by: SJ Park <sj@kernel.org>
+Cc: Yang yingliang <yangyingliang@huawei.com>
+Cc: <stable@vger.kernel.org> # 5.16.x
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: SJ Park <sj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/damon/core.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/mm/damon/core.c
++++ b/mm/damon/core.c
+@@ -215,6 +215,12 @@ int damon_set_regions(struct damon_targe
+ unsigned int i;
+ int err;
+
++ for (i = 0; i < nr_ranges; i++) {
++ if (ALIGN_DOWN(ranges[i].start, min_sz_region) >=
++ ALIGN(ranges[i].end, min_sz_region))
++ return -EINVAL;
++ }
++
+ /* Remove regions which are not in the new ranges */
+ damon_for_each_region_safe(r, next, t) {
+ for (i = 0; i < nr_ranges; i++) {
cxl-fix-cxl_headerlog_size-to-match-ras-capability-size.patch
remoteproc-xlnx-check-remote-core-state.patch
mm-sparse-vmemmap-fix-vmemmap-accounting-underflow.patch
-kho-add-interfaces-to-unpreserve-folios-page-ranges-and-vmalloc.patch
kho-make-sure-scratch-size-is-always-aligned-by-cma_min_alignment_bytes.patch
mtd-maps-vmu-flash-fix-fault-in-unaligned-fixup.patch
thunderbolt-keep-xdomain-reference-during-the-lifetime-of-a-service.patch
pmdomain-imx93-blk-ctrl-extract-phy-as-shared-domain-for-dsi-csi.patch
i3c-mipi-i3c-hci-fix-hot-join-nack.patch
i3c-mipi-i3c-hci-fix-handling-of-shared-irqs-during-early-initialization.patch
+mm-damon-core-validate-ranges-in-damon_set_regions.patch
+mm-damon-core-disallow-overlapping-input-ranges-for-damon_set_regions.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
