From patchwork Fri Dec 8 17:50:18 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: SeongJae Park X-Patchwork-Id: 175981 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:bcd1:0:b0:403:3b70:6f57 with SMTP id r17csp5617736vqy; Fri, 8 Dec 2023 09:50:45 -0800 (PST) X-Google-Smtp-Source: AGHT+IHmhMXZ/UFlDHsiqyQx6sP/4kSgCnJTZVRIzlm+7CUZ/ob26o0Eev/eMu1deDtfK+P+Bq32 X-Received: by 2002:a17:902:ea02:b0:1cc:bf6b:f3b1 with SMTP id s2-20020a170902ea0200b001ccbf6bf3b1mr408009plg.37.1702057845593; Fri, 08 Dec 2023 09:50:45 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1702057845; cv=none; d=google.com; s=arc-20160816; b=0nVAMbP70iP74IVm7YSkGcfcSMv/QyOFfFYIv1wL1Y5sqlMrAkWsj59jnYPzA7nUrr 3fPqWEY3JBrFsG15BoCDpWIfrqPuK5R/nsh4V8ffixfb3y32qCz+G8X4LDk5pmaIgECY Bj0ohRhjidzO0KWojrGmuZvONW3vHQqG9Fn9q6St0u5g/J54zg1XlV48/ESbIjiexkdt sH6JH/doBb08YTDZNXM4PhM5ze0MLBEdNXOHJfLfXLVK4XDVRvzVPyCHvcP54f4TNTRD e19mnQj1ud9Ut6paO5TseTscuMzmI9Kr+l/6W2BTusRILXi3VOyUEFMy4fM02lfmSO1N /VDA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=I9lOd7mXeJ9d5DsCm6Y7KXH5NNhoFNpvoZ5766sIW/k=; fh=Q9tKNroUug/BiPSET0ed46JVG4FgqH+FgKdDpdaV5IE=; b=OY2MdQJHLosX3sJ7Fbtg/U+fpcS6EOaOS7klpIhzAmdgHnYDZvHH3FGPQ33Qet3GuD OR+yrQJRsWkdyedsZE+C91MIyOdop1i3WxAPsnxZZP3FGlQ4AH3rDHfQtKLqIz3kBvam DY23iVSiGzArVXjFDsHwNrbY+nx9EuPvrk3r2dUWiJ0eDC16SomYnGuYpsywnPkVpPkl N0rQDeLUbFUih4/Zee1yuJDKEtZVvi0NnAAj8qVCKvkYR7q89HvArcMiw0lXrYEFy74W YFzo/A+Z0593tHIQNjUQfJZNX0KiBoUpwbYMoze9ZruyhqJxkGdtzyYEW9bWEeUWf7fn PE6w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=UlSeOLw2; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.38 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: from fry.vger.email (fry.vger.email. [23.128.96.38]) by mx.google.com with ESMTPS id l7-20020a170902f68700b001d08f5169dfsi1954456plg.140.2023.12.08.09.50.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 08 Dec 2023 09:50:45 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.38 as permitted sender) client-ip=23.128.96.38; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=UlSeOLw2; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.38 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by fry.vger.email (Postfix) with ESMTP id 8D650807DECF; Fri, 8 Dec 2023 09:50:30 -0800 (PST) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.11 at fry.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1574499AbjLHRuV (ORCPT + 99 others); Fri, 8 Dec 2023 12:50:21 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57626 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1574152AbjLHRuS (ORCPT ); Fri, 8 Dec 2023 12:50:18 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2447AB5 for ; Fri, 8 Dec 2023 09:50:25 -0800 (PST) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1DAA8C433C7; Fri, 8 Dec 2023 17:50:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1702057824; bh=cE24g6fBBFjzqibu8azeRT7zJ49z9KZ0TlE0lX4ftds=; h=From:To:Cc:Subject:Date:From; b=UlSeOLw24RssSEoLnv7u5w3h+UtuX6mWYBL9Sh+sfakwDsCwpeUev4OhHzla9QVIF bmw0uUM0zMIhikMsVXI4flrGhT7nrWczvLfnLb1tmAkKqRyW14rS7PD6Z5Ry7jdCsq T31MPJj9y5Fb8f1Mr6tYtVu+EIl+OHlkmWh8HltLCarJhdvkHS0bABlmDzQUyLNme5 doKc+VWZ76L7RKDPwaz0dnscdzGMwkMtCW0hA9iauFmt54bTg+k2cPE6iXNd0Kdj7X PPJOahPakyNBrLKKgly1pY+FieuiY/zJxO5qc0fKD5sIqAG7IlfdYpioRXermCrnOS 0tBPI3pUhujig== From: SeongJae Park To: Andrew Morton Cc: SeongJae Park , Changbin Du , Jakub Acs , damon@lists.linux.dev, linux-mm@kvack.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH] mm/damon/core: make damon_start() waits until kdamond_fn() starts Date: Fri, 8 Dec 2023 17:50:18 +0000 Message-Id: <20231208175018.63880-1-sj@kernel.org> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-Spam-Status: No, score=-1.2 required=5.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on fry.vger.email Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (fry.vger.email [0.0.0.0]); Fri, 08 Dec 2023 09:50:30 -0800 (PST) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1784737007578707863 X-GMAIL-MSGID: 1784737007578707863 The cleanup tasks of kdamond threads including reset of corresponding DAMON context's ->kdamond field and decrease of global nr_running_ctxs counter is supposed to be executed by kdamond_fn(). However, commit 0f91d13366a4 ("mm/damon: simplify stop mechanism") made neither damon_start() nor damon_stop() ensure the corresponding kdamond has started the execution of kdamond_fn(). As a result, the cleanup can be skipped if damon_stop() is called fast enough after the previous damon_start(). Especially the skipped reset of ->kdamond could cause a use-after-free. Fix it by waiting for start of kdamond_fn() execution from damon_start(). Fixes: 0f91d13366a4 ("mm/damon: simplify stop mechanism") Reported-by: Jakub Acs Cc: # 5.15.x Signed-off-by: SeongJae Park --- Note that the report has not publicly made, so this patch doesn't have a Closes: tag. include/linux/damon.h | 2 ++ mm/damon/core.c | 6 ++++++ 2 files changed, 8 insertions(+) diff --git a/include/linux/damon.h b/include/linux/damon.h index aa34ab433bc5..12510d8c51c6 100644 --- a/include/linux/damon.h +++ b/include/linux/damon.h @@ -579,6 +579,8 @@ struct damon_ctx { * update */ unsigned long next_ops_update_sis; + /* for waiting until the execution of the kdamond_fn is started */ + struct completion kdamond_started; /* public: */ struct task_struct *kdamond; diff --git a/mm/damon/core.c b/mm/damon/core.c index f91715a58dc7..2c0cc65d041e 100644 --- a/mm/damon/core.c +++ b/mm/damon/core.c @@ -445,6 +445,8 @@ struct damon_ctx *damon_new_ctx(void) if (!ctx) return NULL; + init_completion(&ctx->kdamond_started); + ctx->attrs.sample_interval = 5 * 1000; ctx->attrs.aggr_interval = 100 * 1000; ctx->attrs.ops_update_interval = 60 * 1000 * 1000; @@ -668,11 +670,14 @@ static int __damon_start(struct damon_ctx *ctx) mutex_lock(&ctx->kdamond_lock); if (!ctx->kdamond) { err = 0; + reinit_completion(&ctx->kdamond_started); ctx->kdamond = kthread_run(kdamond_fn, ctx, "kdamond.%d", nr_running_ctxs); if (IS_ERR(ctx->kdamond)) { err = PTR_ERR(ctx->kdamond); ctx->kdamond = NULL; + } else { + wait_for_completion(&ctx->kdamond_started); } } mutex_unlock(&ctx->kdamond_lock); @@ -1483,6 +1488,7 @@ static int kdamond_fn(void *data) pr_debug("kdamond (%d) starts\n", current->pid); + complete(&ctx->kdamond_started); kdamond_init_intervals_sis(ctx); if (ctx->ops.init)