damon_apply_min_nr_regions() repeatedly split each region until its size
becomes small enough to meet the user-defined low limit of the number of
regions.  The loop assumes the split operation (damon_split_region_at())
will always succeed and create the new region.  But the operation could
silently fail for memory allocation failures, for example.  If such
failure happens and the region was the last region, the linked
list-based next region fetching returns invalid pointer.  As a result,
invalid memory dereference and corruption could happen.  Fix by breaking
the loop in the corner case.

The allocation failure is unlikely since it is arguably too small to
fail.  But, it could still theoretically happen, and the consequence is
very bad.

This issue was discovered [1] by Sashiko.

[1] https://lore.kernel.org/20260717011834.120715-1-sj@kernel.org

Fixes: b1029f29eb1d ("mm/damon/core: split regions for min_nr_regions")
Cc: <stable@vger.kernel.org> # 7.1.x
Signed-off-by: SJ Park <sj@kernel.org>
---
 mm/damon/core.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/mm/damon/core.c b/mm/damon/core.c
index 603b102ff80f9..ce79918400cde 100644
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -1912,6 +1912,9 @@ static unsigned long damon_apply_min_nr_regions(struct damon_ctx *ctx)
 		damon_for_each_region_safe(r, next, t) {
 			while (damon_sz_region(r) > max_region_sz) {
 				damon_split_region_at(t, r, max_region_sz);
+				/* split might failed */
+				if (r == damon_last_region(t))
+					break;
 				r = damon_next_region(r);
 			}
 		}

base-commit: 47263730d8de68a42ac020f8fcb9044f8c86e1b6
-- 
2.47.3

On Fri, 17 Jul 2026 17:43:00 -0700 SJ Park <sj@kernel.org> wrote:

> damon_apply_min_nr_regions() repeatedly split each region until its size
> becomes small enough to meet the user-defined low limit of the number of
> regions.  The loop assumes the split operation (damon_split_region_at())
> will always succeed and create the new region.  But the operation could
> silently fail for memory allocation failures, for example.  If such
> failure happens and the region was the last region, the linked
> list-based next region fetching returns invalid pointer.  As a result,
> invalid memory dereference and corruption could happen.  Fix by breaking
> the loop in the corner case.

Sashiko found no blocker for this series.  Sashiko sent findings to damon@
mailing list [1], and I replied to all the comments.  Please read those for
details.

[1] https://lore.kernel.org/damon/


Thanks,
SJ

[...]

On Fri, 17 Jul 2026 18:03:12 -0700 SJ Park <sj@kernel.org> wrote:

> On Fri, 17 Jul 2026 17:43:00 -0700 SJ Park <sj@kernel.org> wrote:
> 
> > damon_apply_min_nr_regions() repeatedly split each region until its size
> > becomes small enough to meet the user-defined low limit of the number of
> > regions.  The loop assumes the split operation (damon_split_region_at())
> > will always succeed and create the new region.  But the operation could
> > silently fail for memory allocation failures, for example.  If such
> > failure happens and the region was the last region, the linked
> > list-based next region fetching returns invalid pointer.  As a result,
> > invalid memory dereference and corruption could happen.  Fix by breaking
> > the loop in the corner case.
> 
> Sashiko found no blocker for this series.  Sashiko sent findings to damon@
> mailing list [1], and I replied to all the comments.  Please read those for
> details.

My intention was to add this reply to other mail[1] but I only mistakenly
replied here.

This is true, though.  Sashiko found no issue in this patch.  But that means
nothing since this is an RFC.  I will repost this patch after dropping the RFC
and rebasing to latest mm-new, tomorrow.

[1] https://lore.kernel.org/20260718011322.94001-1-sj@kernel.org

> 
> [1] https://lore.kernel.org/damon/


Thanks,
SJ

[...]