Re: [PATCH 08/11] samples/damon/mtier: stop all contexts with single damon_stop() call

[SJ Park <sj@kernel.org>]

On Mon, 06 Jul 2026 14:21:47 +0000 sashiko-bot@kernel.org wrote:

> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> 
> Pre-existing issues:
> - [High] Missing synchronization between module initialization and the module parameter sysfs store callback can lead to Use-After-Free and NULL pointer dereference.
> --
> 
> commit dbce89ab1942b321167e83b5cb17dfd9002ce893
> Author: SJ Park <sj@kernel.org>
> 
> samples/damon/mtier: stop all contexts with single damon_stop() call
> 
> This commit refactors damon_sample_mtier_stop() to use a single
> damon_stop() call to stop all requested DAMON contexts. The previous
> implementation used two separate calls because damon_stop() could
> theoretically return a failure, but it now always stops all contexts
> successfully.
> 
> > diff --git a/samples/damon/mtier.c b/samples/damon/mtier.c
> > index 90881e8bd441f..ac9c24b92ead8 100644
> > --- a/samples/damon/mtier.c
> > +++ b/samples/damon/mtier.c
> > @@ -200,8 +200,7 @@ static int damon_sample_mtier_start(void)
> >  
> >  static void damon_sample_mtier_stop(void)
> >  {
> > -	damon_stop(ctxs, 1);
> > -	damon_stop(&ctxs[1], 1);
> > +	damon_stop(ctxs, 2);
> [Severity: High]
> This is a pre-existing issue, but could a concurrent sysfs write
> trigger a use-after-free and null pointer dereference here?
> 
> When the module is loaded with the enabled parameter set to true,
> damon_sample_mtier_init() attempts to initialize the ctxs array. If
> initialization fails, such as failing to allocate ctxs[1], it destroys
> ctxs[0] but leaves it as a dangling pointer.
> 
> Concurrently, a userspace process writing to the enable sysfs parameter
> triggers damon_sample_mtier_enable_store(). If this write observes the
> global enabled state as true before the initialization failure resets it
> to false, it proceeds to call damon_sample_mtier_stop().
> 
> When damon_sample_mtier_stop() calls damon_stop(ctxs, 2), it loops over
> both array elements, calling __damon_stop() on them. This dereferences
> the pointers to lock ctx->kdamond_lock, potentially causing a
> use-after-free on ctxs[0] and a null pointer dereference on ctxs[1].

Wrong.  mtier is not a loadable module, so this race cannot happen.

> 
> >  	damon_destroy_ctx(ctxs[0]);
> >  	damon_destroy_ctx(ctxs[1]);
> >  }
> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20260706140628.87414-1-sj@kernel.org?part=8

Thanks,
SJ

[...]