linux-kernel - Re: [PATCH] mm/damon/sysfs-schemes: put damos dests dir after removing its files

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <c5bf56b8-da06-4e17-86bc-1b69af3065cd@ghiti.fr>
Date: Sat, 16 Aug 2025 21:35:50 +0200
From: Alexandre Ghiti <alex@...ti.fr>
To: SeongJae Park <sj@...nel.org>, Andrew Morton <akpm@...ux-foundation.org>
Cc: damon@...ts.linux.dev, kernel-team@...a.com,
 linux-kernel@...r.kernel.org, linux-mm@...ck.org
Subject: Re: [PATCH] mm/damon/sysfs-schemes: put damos dests dir after
 removing its files

Hi SeongJae,

On 8/16/25 18:55, SeongJae Park wrote:
> damon_sysfs_scheme_rm_dirs() puts dests directory kobject before
> removing its internal files.  Sincee putting the kobject frees its
> container struct, and the internal files removal accesses the container,
> use-after-free happens.  Fix it by putting the reference _after_
> removing the files.
>
> Reported-by: Alexandre Ghiti <alex@...ti.fr>
> Closes: https://lore.kernel.org/2d39a734-320d-4341-8f8a-4019eec2dbf2@ghiti.fr
> Fixes: 2cd0bf85a203 ("mm/damon/sysfs-schemes: implement DAMOS action destinations directory") # 6.17.x
> Signed-off-by: SeongJae Park <sj@...nel.org>
> ---
> Not Cc-ing stable@, since the broken commit is in 6.17-rc1 and hence probably
> this fix will land on the mainline before the release of the first 6.17 stable
> kernel (6.17.1).
>
>   mm/damon/sysfs-schemes.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/mm/damon/sysfs-schemes.c b/mm/damon/sysfs-schemes.c
> index 74056bcd6a2c..6536f16006c9 100644
> --- a/mm/damon/sysfs-schemes.c
> +++ b/mm/damon/sysfs-schemes.c
> @@ -2158,8 +2158,8 @@ static void damon_sysfs_scheme_rm_dirs(struct damon_sysfs_scheme *scheme)
>   {
>   	damon_sysfs_access_pattern_rm_dirs(scheme->access_pattern);
>   	kobject_put(&scheme->access_pattern->kobj);
> -	kobject_put(&scheme->dests->kobj);
>   	damos_sysfs_dests_rm_dirs(scheme->dests);
> +	kobject_put(&scheme->dests->kobj);
>   	damon_sysfs_quotas_rm_dirs(scheme->quotas);
>   	kobject_put(&scheme->quotas->kobj);
>   	kobject_put(&scheme->watermarks->kobj);
>
> base-commit: 9aa69ba9d9e220ea1d8ba62592fe7ffba376b2cc


Tested-by: Alexandre Ghiti <alexghiti@...osinc.com>

Thanks for the quick fix!

Alex