[PATCH] mm/damon/core: validate goal nid before accessing node data

Josh Law
2026-03-25T07:31:07Z

damos_get_node_mem_bp() and damos_get_node_memcg_used_bp() pass
goal->nid directly to si_meminfo_node() and NODE_DATA() without
checking that it refers to a valid, online NUMA node. Since
goal->nid is set from userspace via sysfs with no validation, a
negative or out-of-range value causes an out-of-bounds access in
NODE_DATA(), and a valid but offline node gives undefined results.

Add bounds and node_online() checks before using the nid.

Fixes: 0e1c773b501f ("mm/damon/core: introduce damos quota goal metrics for memory node utilization")
Signed-off-by: Josh Law <objecting@objecting.org>
---
mm/damon/core.c | 8 ++++++++
1 file changed, 8 insertions(+)

diff --git a/mm/damon/core.c b/mm/damon/core.c
index 59b709f04975..6ee421141996 100644
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -2227,6 +2227,10 @@ static __kernel_ulong_t damos_get_node_mem_bp(
struct sysinfo i;
__kernel_ulong_t numerator;

+ if (goal->nid < 0 || goal->nid >= MAX_NUMNODES ||
+ !node_online(goal->nid))
+ return 0;
+
si_meminfo_node(&i, goal->nid);
if (goal->metric == DAMOS_QUOTA_NODE_MEM_USED_BP)
numerator = i.totalram - i.freeram;
@@ -2243,6 +2247,10 @@ static unsigned long damos_get_node_memcg_used_bp(
unsigned long used_pages, numerator;
struct sysinfo i;

+ if (goal->nid < 0 || goal->nid >= MAX_NUMNODES ||
+ !node_online(goal->nid))
+ return 0;
+
memcg = mem_cgroup_get_from_id(goal->memcg_id);
if (!memcg) {
if (goal->metric == DAMOS_QUOTA_NODE_MEMCG_USED_BP)
--
2.34.1