[PATCH 0/4] mm/damon/sysfs: fix resource leak and NULL pointer dereferences

Josh Law posted 4 patches 2 weeks, 3 days ago
mm/damon/sysfs.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
[PATCH 0/4] mm/damon/sysfs: fix resource leak and NULL pointer dereferences
Posted by Josh Law 2 weeks, 3 days ago
This series fixes a memory leak and three NULL pointer dereferences in
the DAMON sysfs interface, all in mm/damon/sysfs.c.

Patch 1 fixes a damon_ctx leak in damon_sysfs_commit_input() when
damon_sysfs_new_test_ctx() fails after param_ctx was already built.

Patches 2-4 fix missing contexts->nr checks before dereferencing
contexts_arr[0]. A user can trigger these by setting nr_contexts to 0
via sysfs and then issuing commands that assume a context exists:

  - Patch 2: CLEAR_SCHEMES_TRIED_REGIONS handler in damon_sysfs_handle_cmd()
  - Patch 3: damon_sysfs_update_schemes_tried_regions(), reached via
    UPDATE_SCHEMES_TRIED_BYTES and UPDATE_SCHEMES_TRIED_REGIONS
  - Patch 4: damon_sysfs_repeat_call_fn(), reachable when nr_contexts is
    set to 0 while DAMON is running

Josh Law (4):
  mm/damon/sysfs: fix param_ctx leak on damon_sysfs_new_test_ctx()
    failure
  mm/damon/sysfs: check contexts->nr before clear_schemes_tried_regions
  mm/damon/sysfs: check contexts->nr in update_schemes_tried_regions
  mm/damon/sysfs: check contexts->nr in repeat_call_fn

 mm/damon/sysfs.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

-- 
2.34.1
Re: [PATCH 0/4] mm/damon/sysfs: fix resource leak and NULL pointer dereferences
Posted by Josh Law 2 weeks, 3 days ago

On 19 March 2026 15:57:38 GMT, Josh Law <objecting@objecting.org> wrote:
>This series fixes a memory leak and three NULL pointer dereferences in
>the DAMON sysfs interface, all in mm/damon/sysfs.c.
>
>Patch 1 fixes a damon_ctx leak in damon_sysfs_commit_input() when
>damon_sysfs_new_test_ctx() fails after param_ctx was already built.
>
>Patches 2-4 fix missing contexts->nr checks before dereferencing
>contexts_arr[0]. A user can trigger these by setting nr_contexts to 0
>via sysfs and then issuing commands that assume a context exists:
>
>  - Patch 2: CLEAR_SCHEMES_TRIED_REGIONS handler in damon_sysfs_handle_cmd()
>  - Patch 3: damon_sysfs_update_schemes_tried_regions(), reached via
>    UPDATE_SCHEMES_TRIED_BYTES and UPDATE_SCHEMES_TRIED_REGIONS
>  - Patch 4: damon_sysfs_repeat_call_fn(), reachable when nr_contexts is
>    set to 0 while DAMON is running
>
>Josh Law (4):
>  mm/damon/sysfs: fix param_ctx leak on damon_sysfs_new_test_ctx()
>    failure
>  mm/damon/sysfs: check contexts->nr before clear_schemes_tried_regions
>  mm/damon/sysfs: check contexts->nr in update_schemes_tried_regions
>  mm/damon/sysfs: check contexts->nr in repeat_call_fn
>
> mm/damon/sysfs.c | 11 ++++++++++-
> 1 file changed, 10 insertions(+), 1 deletion(-)
>


[0] <https://sashiko.dev/#/patchset/20260319155742.186627-1-objecting%40objecting.org>



I don't think this is right. Probably best you don't listen to that..

V/R


Josh Law