From nobody Thu Jun 18 08:31:25 2026 Received: from mail-pl1-f169.google.com (mail-pl1-f169.google.com [209.85.214.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A0B463845C9 for ; Mon, 20 Apr 2026 12:54:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.169 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776689653; cv=none; b=kfeVi7+pniS4Msw/xx1FJAbMUakdcXSs3Qi0DX14q/VjbdeSyouhXaLzaLl6E0mlPAQCimuvVhEr+I2ascb0eOt+bWrdkQSAcsGgeOcOroriqZxpvYVc5br2KA9Kwfs8FP5/DtsLOAAYkLWS31TcGgl/3NnUom2rRLhLuAZRjwQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776689653; c=relaxed/simple; bh=52YnQbH20Fn7ucrG3Y3QUGJpLEU04PFKTpj+ckFomaw=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=omf2YrwZh2bYO1r9n1bd/zcn4NQ/aQFUN/y1ZhPS/m11DugYiCAs0jmI3t2AYkMgTtLXIpmLeeMYYzETdLtRV0U2RoPYu0543V59OBRl6IXPVakkUCYWDvjc8x2wik0gVSbD3n3NoGwK0F6bclKfIHp8eBOzT8Win4Bc7TMIzOk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=F0IwP6xY; arc=none smtp.client-ip=209.85.214.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="F0IwP6xY" Received: by mail-pl1-f169.google.com with SMTP id d9443c01a7336-2adff872068so13787855ad.1 for ; Mon, 20 Apr 2026 05:54:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1776689651; x=1777294451; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=21qwcfMPBqAFoGsY5GMYgj3M1yvirBqTjEWNooxl2kM=; b=F0IwP6xYwjunOCT5L4FrONRhAsleN2FY0iLDNdvClmn+sxXwxO0Tc57i9tUVDxv+Du BlszWrCxJKX/3sDwNfmXwmOJogZO00U76eqEBLN6S/CAhbmHEfWxkXxNzkkDTy9SNcu2 cx5bDPbg1U+LGBadkCuJKiQXAQDyZmqjD+yQhBsF/UB+qO/Y/zxDldTz133mAVPkA5yB PcqVNp0JkMwLmXhG03B8LKoanxuqnbgk7hadrr7Q1h1xCUXkQH22yQqvDiuBqugwBWvR WtqmXJmbf0FuFvfFn416rVrf+Ll/l0qiXJcy1ahQxutKa3nhc2e1dqfvHpXMKloTBxif lGfA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776689651; x=1777294451; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=21qwcfMPBqAFoGsY5GMYgj3M1yvirBqTjEWNooxl2kM=; b=nfoVBWxK89WSLp8MGSvDVoIMtbfx5hJbnYgj1ywvFDukSOmej6mk51RmqXYn2x60PI qtwbrJFqQgsBkSIr/5jKm7ThSp9/++d3iLRRRELQFszelnGWZUwMdVZD+QvCmxS6BVBZ EcgNYh1wXfyBZlHqRyQKnA7f2HdWq4yQtqyJoSeT0vrp91Rfpj4X1pHUyGFzPEh13y4j g/H41veRUXxcLTUPwr84OxhCulRSjC4HdYhBwXdSN0+GRUdKmtqnqa2nUUh6oKo402Dt RsH39L58ZxzcIyH+GoWFIn4wLoRJvJVHhdubBun2UE9byn4n9lZEaIT/eOEnrugDeak/ vP0w== X-Forwarded-Encrypted: i=1; AFNElJ+AkwtLb3eYvtXdSNDljvSpeN1uGyAGdYTt07rVHo8dvUCKoaMOtPIVn8UaAZ+voLI16o/01Vcm4VVR9Jo=@vger.kernel.org X-Gm-Message-State: AOJu0YxVm9kG0/6ag564wGPGkGIbbTVrXqhLjbgPN6jPRFeWSve3GORV 2ybSsCHVs5Hs+7pUWxuyKM5j43npGNwEBCK7cihrtKT0FOxL7k7uCart X-Gm-Gg: AeBDievekvFhwAdogmQmvBsrDkthR7qC1OQ/DKV/Hin9kK2XQrduMa9QGrlYuwENcSu 0xKcmB08z61xIJyiN55Q8D67Z6xrDOURVATBai5/PpUHEDMGPFB+pFaOp7H/u1LiELXWdsrYzcE AS+ZzFRyfMcDjo1XIrUgr5sXH+GIY5OWF4JZbV0PmoAcm5SR7sWfIaHYmWmzTcUWP1N41SW3vLn me1fp1zd5MoJNwnnUVP+GIbLZRjZSJXsjIkh+nulpF4MiI5v9KxvrXFYebBpDyKRWALNbJ+NfsN ibyoffMdeQPFJ2tejanbVVsKFeK1qlevnpKIDKrF4+I7HSXslFrNQ0J1jJZkWe6agIBM3MEbha5 70/ru0+Ji9jDa2dbRMZfr0PGX8lDDtitMWtkrGpcxVlh/SdVKY/FjedleH6x4cIYe2nTYqX/qZm 4qPXa6rht9jDONbWF6Pzjr4u3VsuQJNuDnYez1ErgJB1gxpp/1BJVqfA== X-Received: by 2002:a17:902:e746:b0:2b0:60b2:4f8 with SMTP id d9443c01a7336-2b5f9f01725mr164450995ad.15.1776689650901; Mon, 20 Apr 2026 05:54:10 -0700 (PDT) Received: from localhost.tail66efb9.ts.net ([240e:3b5:d06f:a890::1000]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2b5fab2112csm98517395ad.62.2026.04.20.05.54.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 20 Apr 2026 05:54:10 -0700 (PDT) From: Junxi Qian To: linux-mm@kvack.org Cc: sj@kernel.org, akpm@linux-foundation.org, damon@lists.linux.dev, linux-kernel@vger.kernel.org Subject: [PATCH v2] mm/damon/sysfs-schemes: fix use-after-free on memcg_path and goal path Date: Mon, 20 Apr 2026 20:54:05 +0800 Message-Id: <20260420125405.362137-1-qjx1298677004@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260420085332.178473-1-qjx1298677004@gmail.com> References: <20260420085332.178473-1-qjx1298677004@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" memcg_path_store() and path_store() free and replace their respective string pointers without holding damon_sysfs_lock. This creates a race with the kdamond thread, which reads these pointers in damon_sysfs_add_scheme_filters() and damos_sysfs_add_quota_score() via damon_call() during a "commit" operation. The race window is as follows: Thread A (commit): holds damon_sysfs_lock, triggers damon_call() kdamond thread: reads sysfs_filter->memcg_path in damon_sysfs_memcg_path_to_id() Thread B (sysfs): calls memcg_path_store() WITHOUT lock, kfree(filter->memcg_path), replaces pointer Since Thread B does not hold damon_sysfs_lock, the kdamond thread can observe a freed pointer, resulting in a use-after-free when damon_sysfs_memcg_path_eq() dereferences it for string comparison. Similarly, memcg_path_show() and path_show() read the string pointers without holding the lock, so a concurrent store can free the string just before sysfs_emit() dereferences it, causing a use-after-free. KASAN reports the following on v7.0.0-rc5 with CONFIG_KASAN=3Dy: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D BUG: KASAN: double-free in memcg_path_store+0x6e/0xc0 Free of addr ffff888100a086c0 by task exp/149 CPU: 1 UID: 0 PID: 149 Comm: exp Not tainted 7.0.0-rc5-gd38efd7c139a #18 = PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/0= 1/2014 Call Trace: dump_stack_lvl+0x55/0x70 print_report+0xcb/0x5d0 kasan_report_invalid_free+0x94/0xc0 check_slab_allocation+0xde/0x110 kfree+0x114/0x3b0 memcg_path_store+0x6e/0xc0 kernfs_fop_write_iter+0x2fc/0x490 vfs_write+0x8e1/0xcc0 ksys_write+0xee/0x1c0 do_syscall_64+0xfc/0x580 entry_SYSCALL_64_after_hwframe+0x77/0x7f Allocated by task 147 on cpu 0 at 12.364295s: kasan_save_stack+0x24/0x50 kasan_save_track+0x17/0x60 __kasan_kmalloc+0x7f/0x90 __kmalloc_noprof+0x191/0x490 memcg_path_store+0x32/0xc0 kernfs_fop_write_iter+0x2fc/0x490 vfs_write+0x8e1/0xcc0 ksys_write+0xee/0x1c0 Freed by task 150 on cpu 0 at 13.373810s: kasan_save_stack+0x24/0x50 kasan_save_track+0x17/0x60 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x43/0x70 kfree+0x137/0x3b0 memcg_path_store+0x6e/0xc0 kernfs_fop_write_iter+0x2fc/0x490 vfs_write+0x8e1/0xcc0 ksys_write+0xee/0x1c0 The buggy address belongs to the object at ffff888100a086c0 which belongs to the cache kmalloc-8 of size 8 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Fix this by holding damon_sysfs_lock while swapping the path pointer in both memcg_path_store() and path_store(), and while reading the path pointer in memcg_path_show() and path_show(). The actual kfree() is moved outside the lock since the old pointer is no longer reachable once replaced. Fixes: 490a43d07f16 ("mm/damon/sysfs-schemes: free old damon_sysfs_scheme_f= ilter->memcg_path on write") Signed-off-by: Junxi Qian --- Changes in v2: - Also protect memcg_path_show() and path_show() with damon_sysfs_lock, since sysfs show and store callbacks can run concurrently and a lockless read in show can race with the kfree in store. (Sashiko AI) mm/damon/sysfs-schemes.c | 36 ++++++++++++++++++++++++++++-------- 1 file changed, 28 insertions(+), 8 deletions(-) diff --git a/mm/damon/sysfs-schemes.c b/mm/damon/sysfs-schemes.c index 5186966da..1a890e2a4 100644 --- a/mm/damon/sysfs-schemes.c +++ b/mm/damon/sysfs-schemes.c @@ -533,9 +533,14 @@ static ssize_t memcg_path_show(struct kobject *kobj, { struct damon_sysfs_scheme_filter *filter =3D container_of(kobj, struct damon_sysfs_scheme_filter, kobj); + ssize_t len; =20 - return sysfs_emit(buf, "%s\n", + mutex_lock(&damon_sysfs_lock); + len =3D sysfs_emit(buf, "%s\n", filter->memcg_path ? filter->memcg_path : ""); + mutex_unlock(&damon_sysfs_lock); + + return len; } =20 static ssize_t memcg_path_store(struct kobject *kobj, @@ -543,15 +548,20 @@ static ssize_t memcg_path_store(struct kobject *kobj, { struct damon_sysfs_scheme_filter *filter =3D container_of(kobj, struct damon_sysfs_scheme_filter, kobj); - char *path =3D kmalloc_array(size_add(count, 1), sizeof(*path), - GFP_KERNEL); + char *path, *old; =20 + path =3D kmalloc_array(size_add(count, 1), sizeof(*path), GFP_KERNEL); if (!path) return -ENOMEM; =20 strscpy(path, buf, count + 1); - kfree(filter->memcg_path); + + mutex_lock(&damon_sysfs_lock); + old =3D filter->memcg_path; filter->memcg_path =3D path; + mutex_unlock(&damon_sysfs_lock); + + kfree(old); return count; } =20 @@ -1187,8 +1197,13 @@ static ssize_t path_show(struct kobject *kobj, { struct damos_sysfs_quota_goal *goal =3D container_of(kobj, struct damos_sysfs_quota_goal, kobj); + ssize_t len; =20 - return sysfs_emit(buf, "%s\n", goal->path ? goal->path : ""); + mutex_lock(&damon_sysfs_lock); + len =3D sysfs_emit(buf, "%s\n", goal->path ? goal->path : ""); + mutex_unlock(&damon_sysfs_lock); + + return len; } =20 static ssize_t path_store(struct kobject *kobj, @@ -1196,15 +1211,20 @@ static ssize_t path_store(struct kobject *kobj, { struct damos_sysfs_quota_goal *goal =3D container_of(kobj, struct damos_sysfs_quota_goal, kobj); - char *path =3D kmalloc_array(size_add(count, 1), sizeof(*path), - GFP_KERNEL); + char *path, *old; =20 + path =3D kmalloc_array(size_add(count, 1), sizeof(*path), GFP_KERNEL); if (!path) return -ENOMEM; =20 strscpy(path, buf, count + 1); - kfree(goal->path); + + mutex_lock(&damon_sysfs_lock); + old =3D goal->path; goal->path =3D path; + mutex_unlock(&damon_sysfs_lock); + + kfree(old); return count; } =20 --=20 2.34.1