Re: [PATCH 1/2] mm/damon/reclaim: skip damon_call() if ctx has not started

[SJ Park <sj@kernel.org>]

On Mon, 03 Aug 2026 14:06:41 +0000 sashiko-bot@kernel.org wrote:

> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> 
> Pre-existing issues:
> - [Medium] The patch fixes an indefinite hang in `mm/damon/reclaim.c` when `commit_inputs` is written before the context is started, but completely misses the identical vulnerability in `mm/damon/lru_sort.c`.
> --
> 
> --- Patch [1]: [PATCH 1/2] mm/damon/reclaim: skip damon_call() if ctx has not started ---
> commit d00b612017f41a8bee83736cc54b16dba8d079ff
> Author: SJ Park <sj@kernel.org>
> 
> mm/damon/reclaim: skip damon_call() if ctx has not started
> 
> DAMON_RECLAIM calls damon_call() for commit_inputs parameter user input
> if the DAMON context is initialized. The context could be initialized,
> but not yet successfully started. In the case, damon_call() could
> indefinitely hang. Fix the problem by memorizing if the DAMON context
> has ever successfully started, and skip damon_call() if it has not.
> 
> > diff --git a/mm/damon/reclaim.c b/mm/damon/reclaim.c
> > index 09e941d75f67d..45d5557cc575a 100644
> > --- a/mm/damon/reclaim.c
> > +++ b/mm/damon/reclaim.c
> [ ... ]
> > @@ -291,11 +293,8 @@ static int damon_reclaim_commit_inputs_store(const char *val,
> >  	if (!commit_inputs_request)
> >  		return 0;
> >  
> > -	/*
> > -	 * Skip damon_call() if ctx is not initialized to avoid
> > -	 * NULL pointer dereference.
> > -	 */
> > -	if (!ctx)
> > +	/* Skip damon_call() if ctx has not successfully started. */
> > +	if (!damon_reclaim_damon_has_started)
> >  		return -EINVAL;
> >  
> >  	err = damon_call(ctx, &control);
> 
> [Severity: Medium]
> This is a pre-existing issue and was not introduced by the patch under review,
> but does mm/damon/lru_sort.c also need this same fix?
> 
> Looking at damon_lru_sort_commit_inputs_store() in mm/damon/lru_sort.c, it
> retains the identical vulnerable logic that was patched here in reclaim.c:
> 
> mm/damon/lru_sort.c:damon_lru_sort_commit_inputs_store() {
>     ...
>         /*
>          * Skip damon_call() if ctx is not initialized to avoid
>          * NULL pointer dereference.
>          */
>         if (!ctx)
>                 return -EINVAL;
> 
>         err = damon_call(ctx, &control);
>     ...
> }
> 
> If a user writes 'Y' to /sys/module/damon_lru_sort/parameters/commit_inputs
> before the damon_lru_sort module has been turned on for the first time,
> damon_call() is invoked before the kdamond thread has been created.
> Will this cause the caller to hang indefinitely in wait_for_completion()
> just like the reclaim.c version did?
> 
> Should a similar damon_lru_sort_damon_has_started flag be tracked in
> damon_lru_sort_turn() to fix this in lru_sort.c as well?

The next patch of this series fixes the bug.

> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20260803134646.16640-1-sj@kernel.org?part=1


Thanks,
SJ