Re: [PATCH 6.18.y] mm/damon/sysfs: read ops_id only once in damon_sysfs_apply_inputs()

[SJ Park <sj@kernel.org>]

On Wed, 9 Sep 2026 15:01:49 +0200 Greg KH <greg@kroah.com> wrote:

> On Tue, Sep 08, 2026 at 08:28:30PM -0700, SJ Park wrote:
> > damon_sysfs_apply_inputs() reads ops_id twice.  It could race with
> > ops_id_store().  As a result, the min_region_sz could wrongly be set up.
> > Read it once.
> > 
> > The user impact is trivial.  Sane users ain't update the parameter in
> > parallel.  Even if it happens, the DAMON core layer handles the wrong
> > min_region_sz (!is_power_of_2()).  Even if somehow the race ended up
> > making a min_region_sz that is different from the user's intention but
> > still valid, only monitoring itself runs differently than expected.  No
> > critical consequences like kernel panic or memory corruption happen
> > 
> > The issue was discovered [1] by Sashiko.
> > 
> > Link: https://lore.kernel.org/20260715031002.108504-7-sj@kernel.org
> > Link: https://lore.kernel.org/20260703172417.95426-1-sj@kernel.org [1]
> > Fixes: 8d009da32f13 ("mm/damon/sysfs: set damon_ctx->min_sz_region only for paddr use case")
> > Signed-off-by: SJ Park <sj@kernel.org>
> > Cc: <stable@vger.kernel.org> # 6.18.x
> > Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> > (cherry picked from commit 5adaaa28be8a79ddd7e103b171f9d6e14e7fc26e)
> > Signed-off-by: SJ Park <sj@kernel.org>
> > ---
> >  mm/damon/sysfs.c | 6 ++++--
> >  1 file changed, 4 insertions(+), 2 deletions(-)
> > 
> > diff --git a/mm/damon/sysfs.c b/mm/damon/sysfs.c
> > index a6c3e83a3dad5..655e4de69bee8 100644
> > --- a/mm/damon/sysfs.c
> > +++ b/mm/damon/sysfs.c
> > @@ -1432,14 +1432,16 @@ static inline bool damon_sysfs_kdamond_running(
> >  static int damon_sysfs_apply_inputs(struct damon_ctx *ctx,
> >  		struct damon_sysfs_context *sys_ctx)
> >  {
> > +	enum damon_ops_id ops_id;
> >  	int err;
> >  
> > -	err = damon_select_ops(ctx, sys_ctx->ops_id);
> > +	ops_id = READ_ONCE(sys_ctx->ops_id);
> > +	err = damon_select_ops(ctx, ops_id);
> >  	if (err)
> >  		return err;
> >  	ctx->addr_unit = sys_ctx->addr_unit;
> >  	/* addr_unit is respected by only DAMON_OPS_PADDR */
> > -	if (sys_ctx->ops_id == DAMON_OPS_PADDR)
> > +	if (ops_id == DAMON_OPS_PADDR)
> >  		ctx->min_sz_region = max(
> >  				DAMON_MIN_REGION / sys_ctx->addr_unit, 1);
> >  	err = damon_sysfs_set_attrs(ctx, sys_ctx->attrs);
> > -- 
> > 2.47.3
> > 
> > 
> 
> Does not apply :(

Seems a patch in 6.18.50..6.18.51-rc1 is causing the conflict.  I just rebased
the patch on 6.18.51-rc1 and posted as another reply [1].

[1] https://lore.kernel.org/20260910004154.115973-1-sj@kernel.org


Thanks,
SJ

[...]