A DAMON sysfs interface user can start DAMON with a scheme, remove the sysfs directory for the scheme, and then ask update of the scheme's stats. Because the schemes stats update logic doesn't aware of the situation, it results in an invalid memory access. Fix the bug by checking if the scheme sysfs directory exists.
Fixes: 0ac32b8affb5 ("mm/damon/sysfs: support DAMOS stats") Cc: stable@vger.kernel.org # v5.18 Signed-off-by: SeongJae Park sj@kernel.org ---
Note: There are DAMON code refactoring patches in mm-stable. As the refactoring changes the code that this fix is touching, while this fix is for v6.1 hotfix, this patch is based on the latest mainline, not the mm-unstable. In other words, this patch cannot cleanly applied on mm-unstable. You could get this patch based on latest mm-unstable via damon/next tree[1], though.
[1] https://git.kernel.org/pub/scm/linux/kernel/git/sj/linux.git/tree/?h=damon/n...
mm/damon/sysfs.c | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/mm/damon/sysfs.c b/mm/damon/sysfs.c index 9f1219a67e3f..9701ef178a4d 100644 --- a/mm/damon/sysfs.c +++ b/mm/damon/sysfs.c @@ -2339,6 +2339,10 @@ static int damon_sysfs_upd_schemes_stats(struct damon_sysfs_kdamond *kdamond) damon_for_each_scheme(scheme, ctx) { struct damon_sysfs_stats *sysfs_stats;
+ /* user could removed the scheme sysfs dir */ + if (schemes_idx >= sysfs_schemes->nr) + break; + sysfs_stats = sysfs_schemes->schemes_arr[schemes_idx++]->stats; sysfs_stats->nr_tried = scheme->stat.nr_tried; sysfs_stats->sz_tried = scheme->stat.sz_tried;