Re: [RFC PATCH] mm/damon/sysfs-schemes: hold damon_sysfs_lock in target_value_store()

[SJ Park <sj@kernel.org>]

On Tue, 20 Oct 2026 14:54:16 +0000 sashiko-bot@kernel.org wrote:

> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] mm/damon/sysfs-schemes: uninitialized stack read in target_value_store()
> --
> 
> commit f43fea0015fcb1917385f72d150c59603a9ae43c
> Author: SJ Park <sj@kernel.org>
> 
> mm/damon/sysfs-schemes: hold damon_sysfs_lock in target_value_store()
> 
> This commit holds damon_sysfs_lock in target_value_store() while updating
> goal->target_value to prevent a time-of-check-to-time-of-use race with
> damon_sysfs_add_quota_score() that could result in a divide-by-zero.
> 
> > diff --git a/mm/damon/sysfs-schemes.c b/mm/damon/sysfs-schemes.c
> > index 8f083611741fd..55298a17b653a 100644
> > --- a/mm/damon/sysfs-schemes.c
> > +++ b/mm/damon/sysfs-schemes.c
> > @@ -1355,7 +1355,13 @@ static ssize_t target_value_store(struct kobject *kobj,
> >  {
> >  	struct damos_sysfs_quota_goal *goal = container_of(kobj, struct
> >  			damos_sysfs_quota_goal, kobj);
> > -	int err = kstrtoul(buf, 0, &goal->target_value);
> > +	unsigned long target_value;
> > +	int err = kstrtoul(buf, 0, &target_value);
> > +
> > +	if (!mutex_trylock(&damon_sysfs_lock))
> > +		return -EBUSY;
> > +	goal->target_value = target_value;
> > +	mutex_unlock(&damon_sysfs_lock);
> >  
> >  	return err ? err : count;
> >  }
> 
> [Severity: High]
> What happens in target_value_store() if kstrtoul() fails (for example,
> returning -EINVAL or -ERANGE on malformed input) while damon_sysfs_lock is
> not contended?
> 
> Since kstrtoul() leaves target_value untouched on error and err is not
> checked before acquiring the lock, wouldn't this overwrite
> goal->target_value with an uninitialized stack value (which could also be
> read back via target_value_show())? Should err be checked and returned
> immediately after kstrtoul()?

Good catch.  I will check kstrtorul() error and return -EINVAL in the next
version.

> 
> []
> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20261020144726.88978-1-sj@kernel.org?part=1


Thanks,
SJ