From nobody Wed Sep 10 01:53:17 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F0C0A2D979D; Mon, 8 Sep 2025 20:15:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757362524; cv=none; b=UInsEDV57kfsctmRm62VJK4op4NC0K3Z3/KrJBccQMw5nZkWEZe3UAuo7hEtycwVzFFqWq7ZvFafHiHxZE1r8oOTIMB57Uogrz7ElqhlNOUdt8zw9EpCi71+RgnevYjhcgWEfE2BOcUk2nOmmFR54KE1rfCQ4ekAH+gDio5Uttc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757362524; c=relaxed/simple; bh=9plYFMqBRkh39dTcvpAtaB83IpFv91F16IOlzHIVMp0=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=pUGkUpcwdZi0blzrsejRMJad9GutXc8ffVPqLiDlqEKz6SCxXcHJNro2WqM0ZVzdhg3bcHwTb2M9ZC/3Voch02XDwQekal1w/Gm93095wNQ/OJVWIhEW+Y7gg2OxfjXC7DPCliJgtRqCACZ1uZxVFl/R4aupSZDRkTEt6XgbW9w= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=lQWmdD75; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="lQWmdD75" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 41C98C4CEF1; Mon, 8 Sep 2025 20:15:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1757362523; bh=9plYFMqBRkh39dTcvpAtaB83IpFv91F16IOlzHIVMp0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lQWmdD75oE1fORIEtDVZnUGfijmdYkpohDkXtBTHcEbRMY3i0VEH9bmAyXuWUZEvN etTP0HbCeutdXuPv7Tusyu9nrQOG3XZaBWORXdBf3yRK4T+94mFI+j+rm0fjVDkW1U lSRcPraqITfV2GnEQ36gYNVMVfoX4tUV5z0090tTtFCe63uo51STI7vEFtT+ueFTV0 3hRFv2ByyMd9Emh1Jl5Vscb0IfiD2Cub7tRB0FDPj5M+Ft2QgOlIxGf7zky8Y/E1El LrlHS4VteRmDM87wm3TK8btsoB+hrSZwKpO1vPDxlTC53wdvcCZLc17YjBqGqSP79f lFwCrw58BKScg== From: SeongJae Park To: Andrew Morton Cc: SeongJae Park , Yunjeong Mun , damon@lists.linux.dev, kernel-team@meta.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org Subject: [PATCH 1/2] mm/damon/core: introduce damon_call_control->dealloc_on_cancel Date: Mon, 8 Sep 2025 13:15:12 -0700 Message-Id: <20250908201513.60802-2-sj@kernel.org> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20250908201513.60802-1-sj@kernel.org> References: <20250908201513.60802-1-sj@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When damon_call_control->repeat is set, damon_call() is executed asynchronously, and eventually be canceled when kdamond finishes. If the damon_call_control object is dynamically allocated, hence, finding the place to deallocate the object is difficult. Introduce a new damon_call_control field, namely dealloc_on_cancel, to ask the kdamond deallocates those dynamically allocated objects when those are canceled. Signed-off-by: SeongJae Park --- include/linux/damon.h | 2 ++ mm/damon/core.c | 8 ++++++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/include/linux/damon.h b/include/linux/damon.h index ec8716292c09..aa7381be388c 100644 --- a/include/linux/damon.h +++ b/include/linux/damon.h @@ -636,6 +636,7 @@ struct damon_operations { * @data: Data that will be passed to @fn. * @repeat: Repeat invocations. * @return_code: Return code from @fn invocation. + * @dealloc_on_cancel: De-allocate when canceled. * * Control damon_call(), which requests specific kdamond to invoke a given * function. Refer to damon_call() for more details. @@ -645,6 +646,7 @@ struct damon_call_control { void *data; bool repeat; int return_code; + bool dealloc_on_cancel; /* private: internal use only */ /* informs if the kdamond finished handling of the request */ struct completion completion; diff --git a/mm/damon/core.c b/mm/damon/core.c index 7aeb3f24aae8..be5942435d78 100644 --- a/mm/damon/core.c +++ b/mm/damon/core.c @@ -2510,10 +2510,14 @@ static void kdamond_call(struct damon_ctx *ctx, boo= l cancel) mutex_lock(&ctx->call_controls_lock); list_del(&control->list); mutex_unlock(&ctx->call_controls_lock); - if (!control->repeat) + if (!control->repeat) { complete(&control->completion); - else + } else if (control->canceled && control->dealloc_on_cancel) { + kfree(control); + continue; + } else { list_add(&control->list, &repeat_controls); + } } control =3D list_first_entry_or_null(&repeat_controls, struct damon_call_control, list); --=20 2.39.5 From nobody Wed Sep 10 01:53:17 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EB3FE2DA763; Mon, 8 Sep 2025 20:15:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757362525; cv=none; b=uDFMluWv9jA5iB1bixYgq/FLIV3rCNfBRQ4lSosSKi7z/I90NgA4TRFFUslmwUBxAq8vPm5qhtAcO9lvmHzfqm5vP+UtTWM+auHhLK/IJ7+qNBzRL76HV1pKGWiChHti9sYu7kc3t3+J18niRWgepXY7lyKW5jSEHbjDYXiVd74= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757362525; c=relaxed/simple; bh=6l7sUsMc9BUwJH1VJJlKFxxbsFLqRRCzdv+tU76g6rc=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=cNNhZQp3G0IGyo4ZEHYTWfeWPfsoLOxUSxDaiqtMWarcNJb6vWG+xYzQrp4wZ2a9HHuzmxtLRMCuwS9lIGlD0KhRokkpdoWeS+NuM+YP4q9aAeQ12wEWPmVH391D6uzrFEZstWkRpPjq8kSc7QQgyjNOLOMkPORh1wcw2iLc5O4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=SrBc+wGj; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="SrBc+wGj" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4DFA6C4CEF7; Mon, 8 Sep 2025 20:15:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1757362524; bh=6l7sUsMc9BUwJH1VJJlKFxxbsFLqRRCzdv+tU76g6rc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SrBc+wGjdeb3bfhohHg3bEloUhKBNKdHkU9+qFMzkgmwvhaq+OsXq0d/U339DHNoG OELZJYEE674XxT7iaSSL/PdFMr1+uVh3e00VRLGIxqHYfnDkGTgBSVirfszRotWCY8 qQX2Ulef6K5E+/MZ4SjGFIw4t2LQNujS3Jxn89vMdZBnJhG5AdbRXoOvAF1dbx5xb+ zrSfhxb2UMX2s3MrYElBcVWqMcUy3+Dw3Ds8u8Pb9INtcaz2NOFS8NLjP2ovFIzkDs 8HjB6zaPQIq/JD/8Ll98eQYh0svSqH0eHOUCO+2kcJ89qJHc0RY9CFsDhJcRwn6wH4 2G4lWdGdaiCzA== From: SeongJae Park To: Andrew Morton Cc: SeongJae Park , Yunjeong Mun , damon@lists.linux.dev, kernel-team@meta.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org Subject: [PATCH 2/2] mm/damon/sysfs: use dynamically allocated repeat mode damon_call_control Date: Mon, 8 Sep 2025 13:15:13 -0700 Message-Id: <20250908201513.60802-3-sj@kernel.org> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20250908201513.60802-1-sj@kernel.org> References: <20250908201513.60802-1-sj@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" DAMON sysfs interface is using a single global repeat mode damon_call_control variable for refresh_ms handling, for all DAMON contexts. As a result, when there are more than one context, the single global damon_call_control is unexpectedly over-written (corrupted). Particularly the ->link field is overwritten by the multiple contexts and this can cause a user hangup, and/or a kernel crash. Fix it by using dynamically allocated damon_call_control object per DAMON context. Fixes: d809a7c64ba8 ("mm/damon/sysfs: implement refresh_ms file internal wo= rk") # v6.17-rc1 Reported-by: Yunjeong Mun Closes: https://lore.kernel.org/20250904011738.930-1-yunjeong.mun@sk.com Signed-off-by: SeongJae Park --- mm/damon/sysfs.c | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/mm/damon/sysfs.c b/mm/damon/sysfs.c index 6625fb718195..fe4e73d0ebbb 100644 --- a/mm/damon/sysfs.c +++ b/mm/damon/sysfs.c @@ -1569,14 +1569,10 @@ static int damon_sysfs_repeat_call_fn(void *data) return 0; } =20 -static struct damon_call_control damon_sysfs_repeat_call_control =3D { - .fn =3D damon_sysfs_repeat_call_fn, - .repeat =3D true, -}; - static int damon_sysfs_turn_damon_on(struct damon_sysfs_kdamond *kdamond) { struct damon_ctx *ctx; + struct damon_call_control *repeat_call_control; int err; =20 if (damon_sysfs_kdamond_running(kdamond)) @@ -1589,18 +1585,29 @@ static int damon_sysfs_turn_damon_on(struct damon_s= ysfs_kdamond *kdamond) damon_destroy_ctx(kdamond->damon_ctx); kdamond->damon_ctx =3D NULL; =20 + repeat_call_control =3D kmalloc(sizeof(*repeat_call_control), + GFP_KERNEL); + if (!repeat_call_control) + return -ENOMEM; + ctx =3D damon_sysfs_build_ctx(kdamond->contexts->contexts_arr[0]); - if (IS_ERR(ctx)) + if (IS_ERR(ctx)) { + kfree(repeat_call_control); return PTR_ERR(ctx); + } err =3D damon_start(&ctx, 1, false); if (err) { + kfree(repeat_call_control); damon_destroy_ctx(ctx); return err; } kdamond->damon_ctx =3D ctx; =20 - damon_sysfs_repeat_call_control.data =3D kdamond; - damon_call(ctx, &damon_sysfs_repeat_call_control); + repeat_call_control->fn =3D damon_sysfs_repeat_call_fn; + repeat_call_control->data =3D kdamond; + repeat_call_control->repeat =3D true; + repeat_call_control->dealloc_on_cancel =3D true; + damon_call(ctx, repeat_call_control); return err; } =20 --=20 2.39.5