mirror of
https://github.com/torvalds/linux.git
synced 2026-05-12 16:18:45 +02:00
4c04c6b47c
damon_stat_start() always allocates the module's damon_ctx object
(damon_stat_context). Meanwhile, if damon_call() in the function fails,
the damon_ctx object is not deallocated. Hence, if the damon_call() is
failed, and the user writes Y to “enabled” again, the previously
allocated damon_ctx object is leaked.
This cannot simply be fixed by deallocating the damon_ctx object when
damon_call() fails. That's because damon_call() failure doesn't guarantee
the kdamond main function, which accesses the damon_ctx object, is
completely finished. In other words, if damon_stat_start() deallocates
the damon_ctx object after damon_call() failure, the not-yet-terminated
kdamond could access the freed memory (use-after-free).
Fix the leak while avoiding the use-after-free by keeping returning
damon_stat_start() without deallocating the damon_ctx object after
damon_call() failure, but deallocating it when the function is invoked
again and the kdamond is completely terminated. If the kdamond is not yet
terminated, simply return -EAGAIN, as the kdamond will soon be terminated.
The issue was discovered [1] by sashiko.
Link: https://lkml.kernel.org/r/20260402134418.74121-1-sj@kernel.org
Link: https://lore.kernel.org/20260401012428.86694-1-sj@kernel.org [1]
Fixes:
|
||
|---|---|---|
| .. | ||
| tests | ||
| core.c | ||
| Kconfig | ||
| lru_sort.c | ||
| Makefile | ||
| modules-common.c | ||
| modules-common.h | ||
| ops-common.c | ||
| ops-common.h | ||
| paddr.c | ||
| reclaim.c | ||
| stat.c | ||
| sysfs-common.c | ||
| sysfs-common.h | ||
| sysfs-schemes.c | ||
| sysfs.c | ||
| vaddr.c | ||