[PATCH 0/2] mm/damon/{reclaim,lru_sort}: fix commit_inputs infinite hang

[PATCH 0/2] mm/damon/{reclaim,lru_sort}: fix commit_inputs infinite hang

[SJ Park]

Writing 'Y' to commit_inputs parameters of DAMON_RECLAIM and
DAMON_LRU_SORT before the modules were ever turned on causes infinite
hang.  Fix those.

The issue was discovered [1] by Sashiko.

[1] https://lore.kernel.org/20260802173021.762-1-sj@kernel.org

Changes from RFC
- RFC: https://lore.kernel.org/20260802185430.9940-1-sj@kernel.org
- Drop RFC tag.

SJ Park (2):
  mm/damon/reclaim: skip damon_call() if ctx has not started
  mm/damon/lru_sort: skip damon_call() if ctx has not started

 mm/damon/lru_sort.c | 11 ++++++-----
 mm/damon/reclaim.c  | 11 ++++++-----
 2 files changed, 12 insertions(+), 10 deletions(-)


base-commit: a96a4f995fbc65238bcbe94e05bcdbec29a54571
-- 
2.47.3

[PATCH 1/2] mm/damon/reclaim: skip damon_call() if ctx has not started

[SJ Park]

DAMON_RECLAIM calls damon_call() for commit_inputs parameter user input
if the DAMON context is initialized.  The context could be initialized,
but not yet successfully started.  In the case, damon_call() could
indefinitely hang.  Read the comment on damon_call() for more detail.
Fix the problem by memorizing if the DAMON context has ever successfully
started, and skip damon_call() if it has not.

This issue can easily be reproduced by writing Y to commit_inputs on a
system that DAMON_RECLAIM was not turned on before.

Fixes: de3c60e1c831 ("mm/damon: add synchronous commit for commit_inputs")
Cc: <stable@vger.kernel.org> # 7.2.x
Signed-off-by: SJ Park <sj@kernel.org>
---
 mm/damon/reclaim.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/mm/damon/reclaim.c b/mm/damon/reclaim.c
index 09e941d75f67d..45d5557cc575a 100644
--- a/mm/damon/reclaim.c
+++ b/mm/damon/reclaim.c
@@ -271,6 +271,8 @@ static int damon_reclaim_commit_inputs_fn(void *arg)
 	return damon_reclaim_apply_parameters();
 }
 
+static bool damon_reclaim_damon_has_started;
+
 static int damon_reclaim_commit_inputs_store(const char *val,
 					     const struct kernel_param *kp)
 {
@@ -291,11 +293,8 @@ static int damon_reclaim_commit_inputs_store(const char *val,
 	if (!commit_inputs_request)
 		return 0;
 
-	/*
-	 * Skip damon_call() if ctx is not initialized to avoid
-	 * NULL pointer dereference.
-	 */
-	if (!ctx)
+	/* Skip damon_call() if ctx has not successfully started. */
+	if (!damon_reclaim_damon_has_started)
 		return -EINVAL;
 
 	err = damon_call(ctx, &control);
@@ -344,6 +343,8 @@ static int damon_reclaim_turn(bool on)
 	err = damon_start(&ctx, 1, true);
 	if (err)
 		return err;
+	if (!damon_reclaim_damon_has_started)
+		damon_reclaim_damon_has_started = true;
 	return damon_call(ctx, &call_control);
 }
 
-- 
2.47.3

[PATCH 2/2] mm/damon/lru_sort: skip damon_call() if ctx has not started

[SJ Park]

DAMON_LRU_SORT calls damon_call() for commit_inputs parameter user input
if the DAMON context is initialized.  The context could be initialized,
but not yet successfully started.  In the case, damon_call() could
indefinitely hang.  Read the comment on damon_call() for more detail.
Fix the problem by memorizing if the DAMON context has ever successfully
started, and skip damon_call() if it has not.

This issue can easily be reproduced by writing Y to the commit_inputs
parameter file on a system that DAMON_LRU_SORT has not turned on before.

Fixes: de3c60e1c831 ("mm/damon: add synchronous commit for commit_inputs")
Cc: <stable@vger.kernel.org> # 7.2.x
Signed-off-by: SJ Park <sj@kernel.org>
---
 mm/damon/lru_sort.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/mm/damon/lru_sort.c b/mm/damon/lru_sort.c
index 3920d5042f109..bd847829a9907 100644
--- a/mm/damon/lru_sort.c
+++ b/mm/damon/lru_sort.c
@@ -346,6 +346,8 @@ static int damon_lru_sort_commit_inputs_fn(void *arg)
 	return damon_lru_sort_apply_parameters();
 }
 
+static bool damon_lru_sort_damon_has_started;
+
 static int damon_lru_sort_commit_inputs_store(const char *val,
 					      const struct kernel_param *kp)
 {
@@ -366,11 +368,8 @@ static int damon_lru_sort_commit_inputs_store(const char *val,
 	if (!commit_inputs_request)
 		return 0;
 
-	/*
-	 * Skip damon_call() if ctx is not initialized to avoid
-	 * NULL pointer dereference.
-	 */
-	if (!ctx)
+	/* Skip damon_call() if ctx has not successfully started. */
+	if (!damon_lru_sort_damon_has_started)
 		return -EINVAL;
 
 	err = damon_call(ctx, &control);
@@ -423,6 +422,8 @@ static int damon_lru_sort_turn(bool on)
 	err = damon_start(&ctx, 1, true);
 	if (err)
 		return err;
+	if (!damon_lru_sort_damon_has_started)
+		damon_lru_sort_damon_has_started = true;
 	return damon_call(ctx, &call_control);
 }
 
-- 
2.47.3

Re: [PATCH 1/2] mm/damon/reclaim: skip damon_call() if ctx has not started

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Medium] The patch fixes an indefinite hang in `mm/damon/reclaim.c` when `commit_inputs` is written before the context is started, but completely misses the identical vulnerability in `mm/damon/lru_sort.c`.
--

--- Patch [1]: [PATCH 1/2] mm/damon/reclaim: skip damon_call() if ctx has not started ---
commit d00b612017f41a8bee83736cc54b16dba8d079ff
Author: SJ Park <sj@kernel.org>

mm/damon/reclaim: skip damon_call() if ctx has not started

DAMON_RECLAIM calls damon_call() for commit_inputs parameter user input
if the DAMON context is initialized. The context could be initialized,
but not yet successfully started. In the case, damon_call() could
indefinitely hang. Fix the problem by memorizing if the DAMON context
has ever successfully started, and skip damon_call() if it has not.

> diff --git a/mm/damon/reclaim.c b/mm/damon/reclaim.c
> index 09e941d75f67d..45d5557cc575a 100644
> --- a/mm/damon/reclaim.c
> +++ b/mm/damon/reclaim.c
[ ... ]
> @@ -291,11 +293,8 @@ static int damon_reclaim_commit_inputs_store(const char *val,
>  	if (!commit_inputs_request)
>  		return 0;
>  
> -	/*
> -	 * Skip damon_call() if ctx is not initialized to avoid
> -	 * NULL pointer dereference.
> -	 */
> -	if (!ctx)
> +	/* Skip damon_call() if ctx has not successfully started. */
> +	if (!damon_reclaim_damon_has_started)
>  		return -EINVAL;
>  
>  	err = damon_call(ctx, &control);

[Severity: Medium]
This is a pre-existing issue and was not introduced by the patch under review,
but does mm/damon/lru_sort.c also need this same fix?

Looking at damon_lru_sort_commit_inputs_store() in mm/damon/lru_sort.c, it
retains the identical vulnerable logic that was patched here in reclaim.c:

mm/damon/lru_sort.c:damon_lru_sort_commit_inputs_store() {
    ...
        /*
         * Skip damon_call() if ctx is not initialized to avoid
         * NULL pointer dereference.
         */
        if (!ctx)
                return -EINVAL;

        err = damon_call(ctx, &control);
    ...
}

If a user writes 'Y' to /sys/module/damon_lru_sort/parameters/commit_inputs
before the damon_lru_sort module has been turned on for the first time,
damon_call() is invoked before the kdamond thread has been created.
Will this cause the caller to hang indefinitely in wait_for_completion()
just like the reclaim.c version did?

Should a similar damon_lru_sort_damon_has_started flag be tracked in
damon_lru_sort_turn() to fix this in lru_sort.c as well?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260803134646.16640-1-sj@kernel.org?part=1

Re: [PATCH 1/2] mm/damon/reclaim: skip damon_call() if ctx has not started

[SJ Park]

On Mon, 03 Aug 2026 14:06:41 +0000 sashiko-bot@kernel.org wrote:

> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> 
> Pre-existing issues:
> - [Medium] The patch fixes an indefinite hang in `mm/damon/reclaim.c` when `commit_inputs` is written before the context is started, but completely misses the identical vulnerability in `mm/damon/lru_sort.c`.
> --
> 
> --- Patch [1]: [PATCH 1/2] mm/damon/reclaim: skip damon_call() if ctx has not started ---
> commit d00b612017f41a8bee83736cc54b16dba8d079ff
> Author: SJ Park <sj@kernel.org>
> 
> mm/damon/reclaim: skip damon_call() if ctx has not started
> 
> DAMON_RECLAIM calls damon_call() for commit_inputs parameter user input
> if the DAMON context is initialized. The context could be initialized,
> but not yet successfully started. In the case, damon_call() could
> indefinitely hang. Fix the problem by memorizing if the DAMON context
> has ever successfully started, and skip damon_call() if it has not.
> 
> > diff --git a/mm/damon/reclaim.c b/mm/damon/reclaim.c
> > index 09e941d75f67d..45d5557cc575a 100644
> > --- a/mm/damon/reclaim.c
> > +++ b/mm/damon/reclaim.c
> [ ... ]
> > @@ -291,11 +293,8 @@ static int damon_reclaim_commit_inputs_store(const char *val,
> >  	if (!commit_inputs_request)
> >  		return 0;
> >  
> > -	/*
> > -	 * Skip damon_call() if ctx is not initialized to avoid
> > -	 * NULL pointer dereference.
> > -	 */
> > -	if (!ctx)
> > +	/* Skip damon_call() if ctx has not successfully started. */
> > +	if (!damon_reclaim_damon_has_started)
> >  		return -EINVAL;
> >  
> >  	err = damon_call(ctx, &control);
> 
> [Severity: Medium]
> This is a pre-existing issue and was not introduced by the patch under review,
> but does mm/damon/lru_sort.c also need this same fix?
> 
> Looking at damon_lru_sort_commit_inputs_store() in mm/damon/lru_sort.c, it
> retains the identical vulnerable logic that was patched here in reclaim.c:
> 
> mm/damon/lru_sort.c:damon_lru_sort_commit_inputs_store() {
>     ...
>         /*
>          * Skip damon_call() if ctx is not initialized to avoid
>          * NULL pointer dereference.
>          */
>         if (!ctx)
>                 return -EINVAL;
> 
>         err = damon_call(ctx, &control);
>     ...
> }
> 
> If a user writes 'Y' to /sys/module/damon_lru_sort/parameters/commit_inputs
> before the damon_lru_sort module has been turned on for the first time,
> damon_call() is invoked before the kdamond thread has been created.
> Will this cause the caller to hang indefinitely in wait_for_completion()
> just like the reclaim.c version did?
> 
> Should a similar damon_lru_sort_damon_has_started flag be tracked in
> damon_lru_sort_turn() to fix this in lru_sort.c as well?

The next patch of this series fixes the bug.

> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20260803134646.16640-1-sj@kernel.org?part=1


Thanks,
SJ