In damon_pa_mark_accessed_or_deactivate(), the local variable 'folio' is declared but not initialized. If the region [r->ar.start, r->ar.end) is empty or invalid such that the while-loop body is never entered, 'folio' retains an indeterminate (garbage) value. The function then unconditionally assigns this uninitialized pointer to s->last_applied (line 239), resulting in undefined behavior. Subsequent dereference or folio_put() on s->last_applied may cause crashes or memory corruption. Although DAMON regions are typically non-empty, zero-length regions can arise during region merging/splitting or due to address unit alignment — making this path reachable in practice. Fix by initializing 'folio' to NULL. Assigning NULL to s->last_applied is safe and semantically correct: it cleanly indicates "no folio was processed in this invocation", and callers are expected to check for NULL before use (as per common kernel practice). No functional change for non-empty regions; only hardens error/edge case handling. Signed-off-by: Aaron Yang --- mm/damon/paddr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/damon/paddr.c b/mm/damon/paddr.c index 07a8aead439e..32d8024d130e 100644 --- a/mm/damon/paddr.c +++ b/mm/damon/paddr.c @@ -212,7 +212,7 @@ static inline unsigned long damon_pa_mark_accessed_or_deactivate( unsigned long *sz_filter_passed) { phys_addr_t addr, applied = 0; - struct folio *folio; + struct folio *folio = NULL; addr = damon_pa_phys_addr(r->ar.start, addr_unit); while (addr < damon_pa_phys_addr(r->ar.end, addr_unit)) { -- 2.47.3