Re: [RFC PATCH v2] mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()

[SeongJae Park <sj@kernel.org>]

On Sun, 17 May 2026 10:26:21 -0700 SeongJae Park <sj@kernel.org> wrote:

> DAMON sysfs maintains the DAMOS tried region directory objects via a
> linked list.  When the user requests refresh of the directories, DAMON
> sysfs removes all the region directories first, and then generate
> updated regions directory on the empty space.  The removal function
> (damon_sysfs_scheme_regions_rm_dirs()) only puts the kobj objects.
> Deletion of the container region object from the linked list is done
> inside the kobj release callback function.
> 
> If somehow the callback invocation is delayed, the list will contain
> regions list that gonna be freed.  If the updated region directories
> creation is started in this situation, the list can be corrupted and
> use-after-free can happen.
> 
> Because the kobj objects are managed by only DAMON sysfs, the issue
> cannot happen in normal situation.  But, such delays can be made on
> kernels that built with CONFIG_DEBUG_KOBJECT_RELEASE.  On the kernel,
> the issue can indeed be reproduced like below.
> 
>     # damo start --damos_action stat
>     # cd /sys/kernel/mm/damon/admin/kdamonds/0/
>     # for i in {1..10}; do echo update_schemes_tried_regions > state; done
>     # dmesg | grep underflow
>     [   89.296152] refcount_t: underflow; use-after-free.
> 
> Fix the issue by removing the region object from the list when
> decrementing the reference count.
> 
> Also update damos_sysfs_populate_region_dir() to add the region object
> to the list only after the kobject_init_and_add() is success, so that
> fail of kobject_init_and_add() is not leaving the deallocated object on
> the list.
> 
> The issue was discovered [1] by Sashiko.
> 
> [1] https://lore.kernel.org/20260513011920.119183-1-sj@kernel.org

Sashiko failed reviewing [1] this, due to the not-yet-updsated mm-new tree
baseline problem [2].  I will rebase this to mm-stable and repost.

[1] https://sashiko.dev/#/patchset/20260517172624.888-1-sj%40kernel.org
[2] https://lore.kernel.org/20260514205555.51653-1-sj@kernel.org/


Thanks,
SJ

[...]