Re: [PATCH] mm/damon/sysfs-schemes: fix tried_regions setup failure cleanup

[SJ Park <sj@kernel.org>]

On Wed, 08 Jul 2026 08:20:09 +0000 sashiko-bot@kernel.org wrote:

> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> 
> Pre-existing issues:
> - [High] Uninitialized pointer dereference in error path of damon_sysfs_access_pattern_add_dirs()
> --
> 
> --- Patch [1]: [PATCH] mm/damon/sysfs-schemes: fix tried_regions setup failure cleanup ---
> commit b97caf8d3b939c01dca3a53c5340d70ede6714d2
> Author: Guangshuo Li <lgs201920130244@gmail.com>
> 
> mm/damon/sysfs-schemes: fix tried_regions setup failure cleanup
> 
> This commit fixes an uninitialized pointer dereference in the error cleanup
> path of damon_sysfs_scheme_add_dirs(). It changes the failure jump target 
> for damon_sysfs_scheme_set_tried_regions() to avoid calling kobject_put()
> on the uninitialized tried_regions pointer.
> 
> > diff --git a/mm/damon/sysfs-schemes.c b/mm/damon/sysfs-schemes.c
> > index 329cfd0bbe9f3..0668a0e539713 100644
> > --- a/mm/damon/sysfs-schemes.c
> > +++ b/mm/damon/sysfs-schemes.c
> > @@ -2516,12 +2516,12 @@ static int damon_sysfs_scheme_add_dirs(struct damon_sysfs_scheme *scheme)
> >  		goto put_filters_watermarks_quotas_access_pattern_out;
> >  	err = damon_sysfs_scheme_set_tried_regions(scheme);
> >  	if (err)
> > -		goto put_tried_regions_out;
> > +		goto put_stats_out;
> >  	return 0;
> >  
> > -put_tried_regions_out:
> > -	kobject_put(&scheme->tried_regions->kobj);
> > -	scheme->tried_regions = NULL;
> > +put_stats_out:
> > +	kobject_put(&scheme->stats->kobj);
> > +	scheme->stats = NULL;
> 
> [Severity: High]
> This isn't a bug introduced by this patch, but while reviewing this cleanup,
> I noticed the exact same uninitialized pointer dereference exists earlier in
> the same file.
> 
> If damon_sysfs_access_pattern_add_range_dir() fails during the setup of "sz",
> does the error path dereference an uninitialized pointer?
> 
> mm/damon/sysfs-schemes.c:damon_sysfs_access_pattern_add_dirs() {
>     ...
> 	err = damon_sysfs_access_pattern_add_range_dir(access_pattern,
> 			&access_pattern->sz, "sz");
> 	if (err)
> 		goto put_sz_out;
>     ...
> put_sz_out:
> 	kobject_put(&access_pattern->sz->kobj);
> 	access_pattern->sz = NULL;
> 	return err;
> }
> 
> Since damon_sysfs_access_pattern is allocated with kmalloc_obj(), its fields
> are uninitialized. If the directory creation fails, the function returns an
> error without writing to the pointer. The error path then jumps to put_sz_out
> and calls kobject_put() on the garbage pointer access_pattern->sz, identical
> to the bug fixed by this patch.
> 
> Could this be addressed with a similar fix?

This is already fixed in the mainline by commit d58fdbe37a82
("mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs()") to
my understanding.   Let me know if I'm missing something.

> 
> >  put_filters_watermarks_quotas_access_pattern_out:
> >  	kobject_put(&scheme->ops_filters->kobj);
> >  	scheme->ops_filters = NULL;
> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20260708080107.727043-1-lgs201920130244@gmail.com?part=1


Thanks,
SJ