Re: [PATCH 2/2] mm/damon/lru_sort: error out for >10000 active_mem_bp

[David Laight]

On Mon,  3 Aug 2026 06:40:33 -0700
SJ Park <sj@xxxxxxxxxx> wrote:

> damos_quota_score() can trigger division by zero if the target value is
> zero.  DAMON_LRU_SORT lets users set the target value for the hot memory
> scheme via active_mem_bp parameter.  It avoids setting it as the target
> value if the parameter value is zero.  However, it also sets the cold
> memory scheme with a target value that is calculated as '10000 -
> active_mem_bp + 2'.  Hence, if a user sets active_mem_bp 10002, the cold
> memory scheme's quota goal target value can be zero.  As a result,
> division by zero can be triggered.  Fix by returning an error when the
> user tries to start DAMON with >10000 active_mem_bp parameter value.
> 
> It makes no sense to set active_mem_bp with 10002.  It also requires
> module parameters write permission to reproduce the issue.  That said,
> the consequence is quite bad.
> 
> One reliable way to reproduce the issue is like below:
> 
>     # cd /sys/module/damon_lru_sort/parameters
>     # echo 1000 > wmarks_high
>     # echo 995 > wmarks_mid
>     # echo 0 > wmarks_low
>     # echo 10002 > active_mem_bp
>     # echo Y > enabled
>     # dmesg -w
>     [...]
>     [  597.421247] Oops: divide error: 0000 [#1] SMP NOPTI
>     [  597.428848] RIP: 0010:damos_quota_score+0x6f/0x480
> 
> This issue was discovered [1] by Sashiko.
> 
> [1] https://lore.kernel.org/20260801213028.5127-1-sj@xxxxxxxxxx
> 
> Fixes: 40d98d31cd70 ("mm/damon/lru_sort: support active:inactive memory ratio based auto-tuning")
> Cc: <stable@xxxxxxxxxxxxxxx> # 7.0.x
> Signed-off-by: SJ Park <sj@xxxxxxxxxx>
> ---
>  mm/damon/lru_sort.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/mm/damon/lru_sort.c b/mm/damon/lru_sort.c
> index 7e077084cb03a..3920d5042f109 100644
> --- a/mm/damon/lru_sort.c
> +++ b/mm/damon/lru_sort.c
> @@ -233,6 +233,8 @@ static int damon_lru_sort_add_quota_goals(struct damos *hot_scheme,
>  
>  	if (!active_mem_bp)
>  		return 0;
> +	if (10000 < active_mem_bp)

That is backwards...

> +		return -EINVAL;
>  	goal = damos_new_quota_goal(DAMOS_QUOTA_ACTIVE_MEM_BP, active_mem_bp);
>  	if (!goal)
>  		return -ENOMEM;