Re: [PATCH] mm/damon/sysfs-schemes: fix tried_regions setup failure cleanup

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Uninitialized pointer dereference in error path of damon_sysfs_access_pattern_add_dirs()
--

--- Patch [1]: [PATCH] mm/damon/sysfs-schemes: fix tried_regions setup failure cleanup ---
commit b97caf8d3b939c01dca3a53c5340d70ede6714d2
Author: Guangshuo Li <lgs201920130244@gmail.com>

mm/damon/sysfs-schemes: fix tried_regions setup failure cleanup

This commit fixes an uninitialized pointer dereference in the error cleanup
path of damon_sysfs_scheme_add_dirs(). It changes the failure jump target 
for damon_sysfs_scheme_set_tried_regions() to avoid calling kobject_put()
on the uninitialized tried_regions pointer.

> diff --git a/mm/damon/sysfs-schemes.c b/mm/damon/sysfs-schemes.c
> index 329cfd0bbe9f3..0668a0e539713 100644
> --- a/mm/damon/sysfs-schemes.c
> +++ b/mm/damon/sysfs-schemes.c
> @@ -2516,12 +2516,12 @@ static int damon_sysfs_scheme_add_dirs(struct damon_sysfs_scheme *scheme)
>  		goto put_filters_watermarks_quotas_access_pattern_out;
>  	err = damon_sysfs_scheme_set_tried_regions(scheme);
>  	if (err)
> -		goto put_tried_regions_out;
> +		goto put_stats_out;
>  	return 0;
>  
> -put_tried_regions_out:
> -	kobject_put(&scheme->tried_regions->kobj);
> -	scheme->tried_regions = NULL;
> +put_stats_out:
> +	kobject_put(&scheme->stats->kobj);
> +	scheme->stats = NULL;

[Severity: High]
This isn't a bug introduced by this patch, but while reviewing this cleanup,
I noticed the exact same uninitialized pointer dereference exists earlier in
the same file.

If damon_sysfs_access_pattern_add_range_dir() fails during the setup of "sz",
does the error path dereference an uninitialized pointer?

mm/damon/sysfs-schemes.c:damon_sysfs_access_pattern_add_dirs() {
    ...
	err = damon_sysfs_access_pattern_add_range_dir(access_pattern,
			&access_pattern->sz, "sz");
	if (err)
		goto put_sz_out;
    ...
put_sz_out:
	kobject_put(&access_pattern->sz->kobj);
	access_pattern->sz = NULL;
	return err;
}

Since damon_sysfs_access_pattern is allocated with kmalloc_obj(), its fields
are uninitialized. If the directory creation fails, the function returns an
error without writing to the pointer. The error path then jumps to put_sz_out
and calls kobject_put() on the garbage pointer access_pattern->sz, identical
to the bug fixed by this patch.

Could this be addressed with a similar fix?

>  put_filters_watermarks_quotas_access_pattern_out:
>  	kobject_put(&scheme->ops_filters->kobj);
>  	scheme->ops_filters = NULL;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260708080107.727043-1-lgs201920130244@gmail.com?part=1