Re: [PATCH 4/6] samples/damon/mtier: handle damon_stop() failure

[SJ Park <sj@kernel.org>]

On Sun, 28 Jun 2026 22:09:56 +0000 sashiko-bot@kernel.org wrote:

> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> 
> Pre-existing issues:
> - [High] Concurrent execution of module initialization and sysfs parameter write leads to Use-After-Free and NULL pointer dereferences.
> --
> 
> commit f7efff971c5dc6b095a484211734bb0e2a54f858
> Author: SJ Park <sj@kernel.org>
> 
> samples/damon/mtier: handle damon_stop() failure
>     
> damon_sample_mtier_stop() assumes its damon_stop() call will always
> successfully stops the two DAMON contexts. Hence it deallocates the two
> DAMON contexts after the damon_stop() call.
> 
> Link: https://lore.kernel.org/20260609014219.3013-1-sj@kernel.org
> 
> > diff --git a/samples/damon/mtier.c b/samples/damon/mtier.c
> > --- a/samples/damon/mtier.c
> > +++ b/samples/damon/mtier.c
> > @@ -199,7 +199,8 @@ static int damon_sample_mtier_start(void)
> >  
> >  static void damon_sample_mtier_stop(void)
> >  {
> > -	damon_stop(ctxs, 2);
> > +	damon_stop(ctxs, 1);
> > +	damon_stop(&ctxs[1], 1);
> >  	damon_destroy_ctx(ctxs[0]);
> 
> [Severity: High]
> This is a pre-existing issue, but does this function have a concurrency race
> with sysfs parameter writes during module initialization?
> 
> Sysfs parameter nodes are exposed before module_init executes. If a user
> concurrently writes to the enabled sysfs parameter,
> damon_sample_mtier_enable_store() can call damon_sample_mtier_stop() while
> the module is still initializing:
> 
> samples/damon/mtier.c:damon_sample_mtier_init() {
>         ...
>         err = damon_sample_mtier_start();
>         ...
> }
> 
> If damon_sample_mtier_stop() runs before ctxs is initialized, couldn't this
> lead to a NULL pointer dereference when we reach damon_destroy_ctx(ctxs[0])?
> 
> Alternatively, if it runs concurrently with damon_sample_mtier_start(),
> could this cause a use-after-free since the module init function doesn't
> seem to hold a lock to serialize with the sysfs store callback?

Wrong.  mtier is static module.  Cannot be loaded on runtime.  So I'm ignoring
this.


Thanks,
SJ

[...]