Re: [PATCH 1/3] mm/damon/sysfs-schemes: hold damon_sysfs_lock in target_metric_store()

[sashiko-bot@kernel.org]

> damon_sysfs_add_quota_score() reads damos_sysfs_quota_goal->metric
> twice, once to set damos_quota_goal->metric to the value, and once again
> to set the metric-dependent damos_quota_goal unions based on the value.
> 
> target_metrics_score() can update damos_sysfs_quota_goal->metric between
> the two reads.  This time-of-check to time-of-use (toctou) race can make
> the union fields incorrectly set.  The incorrect damos_quota_goal will
> be passed to the core layer and make DAMOS incorrectly behave.
> 
> Users could reproduce the race by writing a new value to the
> target_metric sysfs file while DAMON is starting, or online parameters
> update is ongoing.  The issue will only rarely happen in the real use
> cases.  It requires sysfs write permission.  The race window is short.
> Sane users wouldn't do such writes while DAMON enablement and/or online
> parameters update is ongoing.
> [ ... ]
> [2] https://lore.kernel.org/20261021005234.94107-1-sj@kernel.org
> 
> Fixes: 85fcf0ffc460 ("mm/damon/sysfs-schemes: connect damos_quota_goal nid with core layer")
> Cc: <stable@vger.kernel.org> # 6.16.x
> Signed-off-by: SJ Park <sj@kernel.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261025164808.152048-1-sj@kernel.org?part=1