Re: [PATCH 1/2] mm/damon/reclaim: skip damon_call() if ctx has not started

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Medium] The patch fixes an indefinite hang in `mm/damon/reclaim.c` when `commit_inputs` is written before the context is started, but completely misses the identical vulnerability in `mm/damon/lru_sort.c`.
--

--- Patch [1]: [PATCH 1/2] mm/damon/reclaim: skip damon_call() if ctx has not started ---
commit d00b612017f41a8bee83736cc54b16dba8d079ff
Author: SJ Park <sj@kernel.org>

mm/damon/reclaim: skip damon_call() if ctx has not started

DAMON_RECLAIM calls damon_call() for commit_inputs parameter user input
if the DAMON context is initialized. The context could be initialized,
but not yet successfully started. In the case, damon_call() could
indefinitely hang. Fix the problem by memorizing if the DAMON context
has ever successfully started, and skip damon_call() if it has not.

> diff --git a/mm/damon/reclaim.c b/mm/damon/reclaim.c
> index 09e941d75f67d..45d5557cc575a 100644
> --- a/mm/damon/reclaim.c
> +++ b/mm/damon/reclaim.c
[ ... ]
> @@ -291,11 +293,8 @@ static int damon_reclaim_commit_inputs_store(const char *val,
>  	if (!commit_inputs_request)
>  		return 0;
>  
> -	/*
> -	 * Skip damon_call() if ctx is not initialized to avoid
> -	 * NULL pointer dereference.
> -	 */
> -	if (!ctx)
> +	/* Skip damon_call() if ctx has not successfully started. */
> +	if (!damon_reclaim_damon_has_started)
>  		return -EINVAL;
>  
>  	err = damon_call(ctx, &control);

[Severity: Medium]
This is a pre-existing issue and was not introduced by the patch under review,
but does mm/damon/lru_sort.c also need this same fix?

Looking at damon_lru_sort_commit_inputs_store() in mm/damon/lru_sort.c, it
retains the identical vulnerable logic that was patched here in reclaim.c:

mm/damon/lru_sort.c:damon_lru_sort_commit_inputs_store() {
    ...
        /*
         * Skip damon_call() if ctx is not initialized to avoid
         * NULL pointer dereference.
         */
        if (!ctx)
                return -EINVAL;

        err = damon_call(ctx, &control);
    ...
}

If a user writes 'Y' to /sys/module/damon_lru_sort/parameters/commit_inputs
before the damon_lru_sort module has been turned on for the first time,
damon_call() is invoked before the kdamond thread has been created.
Will this cause the caller to hang indefinitely in wait_for_completion()
just like the reclaim.c version did?

Should a similar damon_lru_sort_damon_has_started flag be tracked in
damon_lru_sort_turn() to fix this in lru_sort.c as well?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260803134646.16640-1-sj@kernel.org?part=1