Re: [RFC PATCH] samples/damon/mtier: handle damon_start() failure

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] `damon_stop()` aborts its loop on the first error, leaving subsequent contexts running and triggering a Use-After-Free when their memory is destroyed.
--

commit 6da87efa9d6982132beff965026bf155183e5c93
Author: SeongJae Park <sj@kernel.org>

samples/damon/mtier: handle damon_start() failure

This commit adds cleanup for damon_start() failures in the memory tiering
DAMON module. When damon_start() fails, it stops any running contexts
and frees them to prevent memory leaks and exclusive mode locks.

Link: https://lore.kernel.org/20260608112455.274231F00893@smtp.kernel.org

> diff --git a/samples/damon/mtier.c b/samples/damon/mtier.c
> index eb1143de8df17..66b591f2180fa 100644
> --- a/samples/damon/mtier.c
> +++ b/samples/damon/mtier.c
[ ... ]
> @@ -185,7 +186,15 @@ static int damon_sample_mtier_start(void)
>  		return -ENOMEM;
>  	}
>  	ctxs[1] = ctx;
> -	return damon_start(ctxs, 2, true);
> +	err = damon_start(ctxs, 2, true);
> +	if (!err)
> +		return 0;
> +
> +	if (damon_is_running(ctxs[0]))
> +		damon_stop(ctxs, 1);
> +	damon_destroy_ctx(ctxs[0]);
> +	damon_destroy_ctx(ctxs[1]);
> +	return err;
>  }
>  
>  static void damon_sample_mtier_stop(void)

[Severity: High]
This is a pre-existing issue, but does damon_stop() leave contexts running
and cause a use-after-free here?

Looking at damon_stop() in mm/damon/core.c:

int damon_stop(struct damon_ctx **ctxs, int nr_ctxs)
{
	int i, err = 0;

	for (i = 0; i < nr_ctxs; i++) {
		err = __damon_stop(ctxs[i]);
		if (err)
			break;
	}
	return err;
}

If __damon_stop() returns an error for the first context (for instance, if
the kthread exited prematurely due to an allocation failure), the loop
breaks immediately.

When damon_sample_mtier_stop() calls damon_stop(ctxs, 2), this would mean
ctxs[1] is never stopped if stopping ctxs[0] returns an error.

The subsequent unconditional calls to damon_destroy_ctx(ctxs[1]) in
damon_sample_mtier_stop() would then free the context, its targets, and its
schemes while kdamond is still executing and dereferencing them.

Can this lead to a use-after-free?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260609005443.2122-1-sj@kernel.org?part=1