Re: [RFC PATCH 6.6.y 3/3] mm/damon/core: remove unreachable damos charge_{target,addr}_from

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] mm/damon/core: dangling pointer ABA match in
  damos_fix_stale_charge_pointers()
--

commit f7e621ee98abae5b2fb7828ae72ea3e96d1173fd
Author: SJ Park <sj@kernel.org>

mm/damon/core: remove unreachable damos charge_{target,addr}_from

This commit adds damos_fix_stale_charge_pointers() to damos_adjust_quota() to
reset quota->charge_target_from and quota->charge_addr_from when the target is
no longer in the context or has no regions.

Link: https://lore.kernel.org/20261020023958.108276-1-sj@kernel.org

> diff --git a/mm/damon/core.c b/mm/damon/core.c
> index 99e934a6d1ce9..61d45d40fc1d3 100644
> --- a/mm/damon/core.c
> +++ b/mm/damon/core.c
> @@ -1088,6 +1088,27 @@ static void damos_set_effective_quota(struct damos_quota *quota)
>  	quota->esz = esz;
>  }
>  
> +
> +static void damos_fix_stale_charge_pointers(struct damon_ctx *c,
> +		struct damos *s)
> +{
> +	struct damos_quota *quota;
> +	struct damon_target *t;
> +
> +	quota = &s->quota;
> +	if (!quota->charge_target_from)
> +		return;
> +	damon_for_each_target(t, c) {
> +		if (t == quota->charge_target_from) {
> +			if (damon_nr_regions(t) > 0)
> +				return;
> +			break;
> +		}
> +	}
> +	quota->charge_target_from = NULL;
> +	quota->charge_addr_from = 0;
> +}

[Severity: Medium]
Can t == quota->charge_target_from falsely match a newly allocated
damon_target if the old one was freed and its slab slot reused before
damos_adjust_quota() runs?

When an online commit removes a target in damon_sysfs_apply_inputs(),
damon_sysfs_set_targets() frees the damon_target via damon_destroy_target(),
leaving quota->charge_target_from dangling, while damon_set_attrs() advances
s->next_apply_sis past ctx->passed_sample_intervals so kdamond_apply_schemes()
skips damos_adjust_quota() on that cycle.  If another target is added before
damos_adjust_quota() next runs, kmalloc() can allocate the new damon_target at
the same address, causing damos_fix_stale_charge_pointers() to return early
and leave the stale charge_target_from and charge_addr_from values active in
damos_skip_charged_region().  Clearing charge_target_from and charge_addr_from
when the target is destroyed during commit would avoid keeping a dangling
pointer.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261107222202.331476-1-sj@kernel.org?part=3