Re: (sashiko review) [PATCH] mm/damon/core: validate goal nid before accessing node data

Josh Law
2026-03-25T16:16:30Z

On 25 March 2026 15:04:10 GMT, SeongJae Park <sj@kernel.org> wrote:
>On Wed, 25 Mar 2026 07:37:39 -0700 SeongJae Park <sj@kernel.org> wrote:
>
>> Forwarding Sashiko review for doing discussions via mails.
>>
>> # review url: https://sashiko.dev/#/patchset/20260325073034.140353-1-objecting@objecting.org
>> # start of sashiko.dev inline review
>> commit 7e17cbe1dc95a0cd1a1410be38ab6964f78fb15c
>> Author: Josh Law <objecting@objecting.org>
>>
>> mm/damon/core: validate goal nid before accessing node data
>>
>> This commit adds bounds checking and node_online() validation for the
>> goal->nid in the DAMON quota metrics. It prevents out-of-bounds accesses
>> to NODE_DATA() when an invalid or offline NUMA node is provided by userspace.
>>
>> > diff --git a/mm/damon/core.c b/mm/damon/core.c
>> > index db6c67e52d2b..81ce27baa1a1 100644
>> > --- a/mm/damon/core.c
>> > +++ b/mm/damon/core.c
>> > @@ -2245,6 +2245,10 @@ static __kernel_ulong_t damos_get_node_mem_bp(
>> > struct sysinfo i;
>> > __kernel_ulong_t numerator;
>> >
>> > + if (goal->nid < 0 || goal->nid >= MAX_NUMNODES ||
>> > + !node_online(goal->nid))
>> > + return 0;
>> > +
>> > si_meminfo_node(&i, goal->nid);
>> > if (goal->metric == DAMOS_QUOTA_NODE_MEM_USED_BP)
>> > numerator = i.totalram - i.freeram;
>> > else /* DAMOS_QUOTA_NODE_MEM_FREE_BP */
>> > numerator = i.freeram;
>> > return mult_frac(numerator, 10000, i.totalram);
>>
>> Could this cause a division by zero if the node is online but memoryless?
>>
>> For CPU-only compute nodes or nodes where all memory has been hot-removed,
>> node_online(goal->nid) will evaluate to true. When si_meminfo_node() is
>> called for these memoryless nodes, it populates the sysinfo struct with
>> i.totalram = 0.
>>
>> The mult_frac() macro unconditionally performs integer division and modulo
>> by the third argument, which could trigger a kernel panic when dividing by
>> zero.
>>
>> Would it be safer to check if i.totalram is zero before returning, or use
>> node_state(goal->nid, N_MEMORY) instead of node_online()?
>>
>> [ ... ]
>>
>> > @@ -2261,6 +2265,10 @@ static unsigned long damos_get_node_memcg_used_bp(
>> > unsigned long used_pages, numerator;
>> > struct sysinfo i;
>> >
>> > + if (goal->nid < 0 || goal->nid >= MAX_NUMNODES ||
>> > + !node_online(goal->nid))
>> > + return 0;
>> > +
>> > memcg = mem_cgroup_get_from_id(goal->memcg_id);
>>
>> The same division by zero risk exists here when mult_frac() is called at the
>> end of this function.
>
>I think sashiko's comments make sense. I also suggested using
>node_state(N_MEMORY). What do you think, Josh?
>
>
>Thanks,
>SJ
>
>[...]

Yep, will do