From: Greg Kroah-Hartman Date: Thu, 30 Jul 2026 12:35:00 +0000 (+0200) Subject: 6.18-stable patches X-Git-Tag: v6.6.148~35 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3ece4665b78cd07e4808d4aaf24b0a551027a953;p=thirdparty%2Fkernel%2Fstable-queue.git 6.18-stable patches added patches: mm-damon-core-disallow-overlapping-input-ranges-for-damon_set_regions.patch mm-damon-core-validate-ranges-in-damon_set_regions.patch --- diff --git a/queue-6.18/kho-make-sure-scratch-size-is-always-aligned-by-cma_min_alignment_bytes.patch b/queue-6.18/kho-make-sure-scratch-size-is-always-aligned-by-cma_min_alignment_bytes.patch index 8673de8891..097927e393 100644 --- a/queue-6.18/kho-make-sure-scratch-size-is-always-aligned-by-cma_min_alignment_bytes.patch +++ b/queue-6.18/kho-make-sure-scratch-size-is-always-aligned-by-cma_min_alignment_bytes.patch @@ -32,7 +32,7 @@ Signed-off-by: Greg Kroah-Hartman --- a/kernel/kexec_handover.c +++ b/kernel/kexec_handover.c -@@ -569,20 +569,30 @@ early_param("kho_scratch", kho_parse_scr +@@ -562,20 +562,30 @@ early_param("kho_scratch", kho_parse_scr static void __init scratch_size_update(void) { diff --git a/queue-6.18/mm-damon-core-disallow-overlapping-input-ranges-for-damon_set_regions.patch b/queue-6.18/mm-damon-core-disallow-overlapping-input-ranges-for-damon_set_regions.patch new file mode 100644 index 0000000000..f0efd6823e --- /dev/null +++ b/queue-6.18/mm-damon-core-disallow-overlapping-input-ranges-for-damon_set_regions.patch @@ -0,0 +1,71 @@ +From 954157679ec34661c2e87e7eb796104a797c32db Mon Sep 17 00:00:00 2001 +From: SJ Park +Date: Fri, 3 Jul 2026 09:56:08 -0700 +Subject: mm/damon/core: disallow overlapping input ranges for damon_set_regions() + +From: SJ Park + +commit 954157679ec34661c2e87e7eb796104a797c32db upstream. + +damon_set_regions() assumes the input ranges are sorted by the address and +don't overlap each other. Hence the assumption was initially to be +explicitly validated. But commit 97d482f4592f ("mm/damon/sysfs: reuse +damon_set_regions() for regions setting") has mistakenly removed the +validation. + +This can make DAMON behave in unexpected ways. At the best, the +monitoring results snapshot will just look weird since there will be +overlapping regions. DAMOS will also work weirdly, applying the same +action multiple times for overlapping regions, and make DAMOS quota weird. +More seriously, depending on the setup and regions updates sequence, +negative size regions can be made. It will trigger WARN_ONCE() if the +kernel is built with CONFIG_DAMON_DEBUG_SANITY=y. Depending on the +monitoring results, the negative size region can further trigger division +by zero in damon_merge_two_regions(). + +Note that some of the consequences including the WARN_ONCE() and the +divide by zero depend on commits that were introduced after the root cause +commit 97d482f4592f ("mm/damon/sysfs: reuse damon_set_regions() for +regions setting"). + +Fix the problems by checking the assumption and returning an error if +the input ranges don't meet the assumption. + +The issue was discovered [1] by Sashiko. + +Link: https://lore.kernel.org/20260703165610.92894-1-sj@kernel.org +Link: https://lore.kernel.org/20260630041806.151124-1-sj@kernel.org [1] +Fixes: 97d482f4592f ("mm/damon/sysfs: reuse damon_set_regions() for regions setting") +Signed-off-by: SJ Park +Cc: # 5.19.x +Signed-off-by: Andrew Morton +Signed-off-by: SJ Park +Signed-off-by: Greg Kroah-Hartman +--- + mm/damon/core.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/mm/damon/core.c ++++ b/mm/damon/core.c +@@ -213,12 +213,19 @@ int damon_set_regions(struct damon_targe + { + struct damon_region *r, *next; + unsigned int i; ++ unsigned long last_end; + int err; + + for (i = 0; i < nr_ranges; i++) { +- if (ALIGN_DOWN(ranges[i].start, min_sz_region) >= +- ALIGN(ranges[i].end, min_sz_region)) ++ unsigned long start, end; ++ ++ start = ALIGN_DOWN(ranges[i].start, min_sz_region); ++ end = ALIGN(ranges[i].end, min_sz_region); ++ if (start >= end) ++ return -EINVAL; ++ if (i > 0 && last_end > start) + return -EINVAL; ++ last_end = end; + } + + /* Remove regions which are not in the new ranges */ diff --git a/queue-6.18/mm-damon-core-validate-ranges-in-damon_set_regions.patch b/queue-6.18/mm-damon-core-validate-ranges-in-damon_set_regions.patch new file mode 100644 index 0000000000..31b8f20a54 --- /dev/null +++ b/queue-6.18/mm-damon-core-validate-ranges-in-damon_set_regions.patch @@ -0,0 +1,61 @@ +From 1292c0ecb1caefb8ca064a3639d5673991e8810c Mon Sep 17 00:00:00 2001 +From: SJ Park +Date: Mon, 29 Jun 2026 20:52:19 -0700 +Subject: mm/damon/core: validate ranges in damon_set_regions() + +From: SJ Park + +commit 1292c0ecb1caefb8ca064a3639d5673991e8810c upstream. + +DAMON core logic assumes zero length regions don't exist. However, a few +DAMON API callers including DAMON_SYSFS, DAMON_RECLAIM and DAMON_LRU_SORT +allow users to set empty monitoring target regions. This could result in +WARN_ONCE() on CONFIG_DAMON_DEBUG_SANITY enabled kernel, and +divide-by-zero from damon_merge_two_regions(). + +For example, the WANR_ONCE() can be triggered like below. + + # grep DAMON_DEBUG_SANITY /boot/config-$(uname -r) + # CONFIG_DAMON_DEBUG_SANITY=y + # damo start + # cd /sys/kernel/mm/damon/admin/kdamonds/0 + # echo 0 > contexts/0/targets/0/regions/0/start + # echo 0 > contexts/0/targets/0/regions/0/end + # echo commit > state + # dmesg + [....] + [ 73.705780] ------------[ cut here ]------------ + [ 73.707552] start 0 >= end 0 + [ 73.708452] WARNING: mm/damon/core.c:359 at damon_new_region+0x6e/0x80, CPU#1: kdamond.0/758 + [...] + +All DAMON API callers eventually use damon_set_regions() to setup the +regions. Add the validation logic in the function. + +Link: https://lore.kernel.org/20260630035221.146458-1-sj@kernel.org +Fixes: 43b0536cb471 ("mm/damon: introduce DAMON-based Reclamation (DAMON_RECLAIM)") +Signed-off-by: SJ Park +Cc: Yang yingliang +Cc: # 5.16.x +Signed-off-by: Andrew Morton +Signed-off-by: SJ Park +Signed-off-by: Greg Kroah-Hartman +--- + mm/damon/core.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/mm/damon/core.c ++++ b/mm/damon/core.c +@@ -215,6 +215,12 @@ int damon_set_regions(struct damon_targe + unsigned int i; + int err; + ++ for (i = 0; i < nr_ranges; i++) { ++ if (ALIGN_DOWN(ranges[i].start, min_sz_region) >= ++ ALIGN(ranges[i].end, min_sz_region)) ++ return -EINVAL; ++ } ++ + /* Remove regions which are not in the new ranges */ + damon_for_each_region_safe(r, next, t) { + for (i = 0; i < nr_ranges; i++) { diff --git a/queue-6.18/series b/queue-6.18/series index 2ffc8e1b84..5646d49cb8 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -637,7 +637,6 @@ cxl-pci-remove-cxl-vh-handling-in-config_pcieaer_cxl-conditional-blocks-from-cor cxl-fix-cxl_headerlog_size-to-match-ras-capability-size.patch remoteproc-xlnx-check-remote-core-state.patch mm-sparse-vmemmap-fix-vmemmap-accounting-underflow.patch -kho-add-interfaces-to-unpreserve-folios-page-ranges-and-vmalloc.patch kho-make-sure-scratch-size-is-always-aligned-by-cma_min_alignment_bytes.patch mtd-maps-vmu-flash-fix-fault-in-unaligned-fixup.patch thunderbolt-keep-xdomain-reference-during-the-lifetime-of-a-service.patch @@ -670,3 +669,5 @@ pmdomain-imx93-blk-ctrl-convert-to-devm_-only.patch pmdomain-imx93-blk-ctrl-extract-phy-as-shared-domain-for-dsi-csi.patch i3c-mipi-i3c-hci-fix-hot-join-nack.patch i3c-mipi-i3c-hci-fix-handling-of-shared-irqs-during-early-initialization.patch +mm-damon-core-validate-ranges-in-damon_set_regions.patch +mm-damon-core-disallow-overlapping-input-ranges-for-damon_set_regions.patch