Re: [PATCH 08/11] samples/damon/mtier: stop all contexts with single damon_stop() call

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing synchronization between module initialization and the module parameter sysfs store callback can lead to Use-After-Free and NULL pointer dereference.
--

commit dbce89ab1942b321167e83b5cb17dfd9002ce893
Author: SJ Park <sj@kernel.org>

samples/damon/mtier: stop all contexts with single damon_stop() call

This commit refactors damon_sample_mtier_stop() to use a single
damon_stop() call to stop all requested DAMON contexts. The previous
implementation used two separate calls because damon_stop() could
theoretically return a failure, but it now always stops all contexts
successfully.

> diff --git a/samples/damon/mtier.c b/samples/damon/mtier.c
> index 90881e8bd441f..ac9c24b92ead8 100644
> --- a/samples/damon/mtier.c
> +++ b/samples/damon/mtier.c
> @@ -200,8 +200,7 @@ static int damon_sample_mtier_start(void)
>  
>  static void damon_sample_mtier_stop(void)
>  {
> -	damon_stop(ctxs, 1);
> -	damon_stop(&ctxs[1], 1);
> +	damon_stop(ctxs, 2);
[Severity: High]
This is a pre-existing issue, but could a concurrent sysfs write
trigger a use-after-free and null pointer dereference here?

When the module is loaded with the enabled parameter set to true,
damon_sample_mtier_init() attempts to initialize the ctxs array. If
initialization fails, such as failing to allocate ctxs[1], it destroys
ctxs[0] but leaves it as a dangling pointer.

Concurrently, a userspace process writing to the enable sysfs parameter
triggers damon_sample_mtier_enable_store(). If this write observes the
global enabled state as true before the initialization failure resets it
to false, it proceeds to call damon_sample_mtier_stop().

When damon_sample_mtier_stop() calls damon_stop(ctxs, 2), it loops over
both array elements, calling __damon_stop() on them. This dereferences
the pointers to lock ctx->kdamond_lock, potentially causing a
use-after-free on ctxs[0] and a null pointer dereference on ctxs[1].

>  	damon_destroy_ctx(ctxs[0]);
>  	damon_destroy_ctx(ctxs[1]);
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260706140628.87414-1-sj@kernel.org?part=8