Re: [PATCH 6.18.y] mm/damon/sysfs: read ops_id only once in damon_sysfs_apply_inputs()

[Greg KH <greg@kroah.com>]

On Tue, Sep 08, 2026 at 08:28:30PM -0700, SJ Park wrote:
> damon_sysfs_apply_inputs() reads ops_id twice.  It could race with
> ops_id_store().  As a result, the min_region_sz could wrongly be set up.
> Read it once.
> 
> The user impact is trivial.  Sane users ain't update the parameter in
> parallel.  Even if it happens, the DAMON core layer handles the wrong
> min_region_sz (!is_power_of_2()).  Even if somehow the race ended up
> making a min_region_sz that is different from the user's intention but
> still valid, only monitoring itself runs differently than expected.  No
> critical consequences like kernel panic or memory corruption happen
> 
> The issue was discovered [1] by Sashiko.
> 
> Link: https://lore.kernel.org/20260715031002.108504-7-sj@kernel.org
> Link: https://lore.kernel.org/20260703172417.95426-1-sj@kernel.org [1]
> Fixes: 8d009da32f13 ("mm/damon/sysfs: set damon_ctx->min_sz_region only for paddr use case")
> Signed-off-by: SJ Park <sj@kernel.org>
> Cc: <stable@vger.kernel.org> # 6.18.x
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> (cherry picked from commit 5adaaa28be8a79ddd7e103b171f9d6e14e7fc26e)
> Signed-off-by: SJ Park <sj@kernel.org>
> ---
>  mm/damon/sysfs.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/mm/damon/sysfs.c b/mm/damon/sysfs.c
> index a6c3e83a3dad5..655e4de69bee8 100644
> --- a/mm/damon/sysfs.c
> +++ b/mm/damon/sysfs.c
> @@ -1432,14 +1432,16 @@ static inline bool damon_sysfs_kdamond_running(
>  static int damon_sysfs_apply_inputs(struct damon_ctx *ctx,
>  		struct damon_sysfs_context *sys_ctx)
>  {
> +	enum damon_ops_id ops_id;
>  	int err;
>  
> -	err = damon_select_ops(ctx, sys_ctx->ops_id);
> +	ops_id = READ_ONCE(sys_ctx->ops_id);
> +	err = damon_select_ops(ctx, ops_id);
>  	if (err)
>  		return err;
>  	ctx->addr_unit = sys_ctx->addr_unit;
>  	/* addr_unit is respected by only DAMON_OPS_PADDR */
> -	if (sys_ctx->ops_id == DAMON_OPS_PADDR)
> +	if (ops_id == DAMON_OPS_PADDR)
>  		ctx->min_sz_region = max(
>  				DAMON_MIN_REGION / sys_ctx->addr_unit, 1);
>  	err = damon_sysfs_set_attrs(ctx, sys_ctx->attrs);
> -- 
> 2.47.3
> 
> 

Does not apply :(