mm/damon/{reclaim,lru_sort}: fix commit_inputs infinite hang

PATCH Applied SJ Park 2 participants 5 messages Aug 3

Subsystems (3)

Stable branch Memory management DAMON

lore

Share & tools

lore

SJ Park

author maintainer

2026-08-03 13:46 UTC #0 lore raw

cover mm/damon/{reclaim,lru_sort}: fix commit_inputs infinite hang

Writing 'Y' to commit_inputs parameters of DAMON_RECLAIM and DAMON_LRU_SORT before the modules were ever turned on causes infinite hang. Fix those.

The issue was discovered [1] by Sashiko.

[1] https://lore.kernel.org/[email protected]

Changes from RFC
- RFC: https://lore.kernel.org/[email protected]
- Drop RFC tag.

SJ Park (2):
mm/damon/reclaim: skip damon_call() if ctx has not started mm/damon/lru_sort: skip damon_call() if ctx has not started

 mm/damon/lru_sort.c | 11 ++++++-----
 mm/damon/reclaim.c  | 11 ++++++-----
 2 files changed, 12 insertions(+), 10 deletions(-)

base-commit: a96a4f995fbc65238bcbe94e05bcdbec29a54571

Signature · 1 line

2.47.3

SJ Park

author maintainer

2026-08-03 13:46 UTC #1 lore raw

PATCH 1/2 mm/damon/reclaim: skip damon_call() if ctx has not started

DAMON_RECLAIM calls damon_call() for commit_inputs parameter user input if the DAMON context is initialized. The context could be initialized, but not yet successfully started. In the case, damon_call() could indefinitely hang. Read the comment on damon_call() for more detail. Fix the problem by memorizing if the DAMON context has ever successfully started, and skip damon_call() if it has not.

This issue can easily be reproduced by writing Y to commit_inputs on a system that DAMON_RECLAIM was not turned on before.

Fixes de3c60e1c831 ("mm/damon: add synchronous commit for commit_inputs")

Cc <[email protected]> # 7.2.x

Signed-off-by SJ Park <[email protected]>

---
 mm/damon/reclaim.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

mm/damon/reclaim.c +6 -5

index 09e941d75f67d..45d5557cc575a 100644
@@ -271,6 +271,8 @@ static int damon_reclaim_commit_inputs_fn(void *arg)
 	return damon_reclaim_apply_parameters();
 }
 
+static bool damon_reclaim_damon_has_started;
+
 static int damon_reclaim_commit_inputs_store(const char *val,
 					     const struct kernel_param *kp)
 {

@@ -291,11 +293,8 @@ static int damon_reclaim_commit_inputs_store(const char *val,
 	if (!commit_inputs_request)
 		return 0;
 
-	/*
-	 * Skip damon_call() if ctx is not initialized to avoid
-	 * NULL pointer dereference.
-	 */
-	if (!ctx)
+	/* Skip damon_call() if ctx has not successfully started. */
+	if (!damon_reclaim_damon_has_started)
 		return -EINVAL;
 
 	err = damon_call(ctx, &control);

@@ -344,6 +343,8 @@ static int damon_reclaim_turn(bool on)
 	err = damon_start(&ctx, 1, true);
 	if (err)
 		return err;
+	if (!damon_reclaim_damon_has_started)
+		damon_reclaim_damon_has_started = true;
 	return damon_call(ctx, &call_control);
 }

Signature · 1 line

2.47.3

[email protected]

AI review

2026-08-03 14:06 UTC #2 lore raw

Re: [PATCH 1/2] mm/damon/reclaim: skip damon_call() if ctx has not started

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Medium] The patch fixes an indefinite hang in mm/damon/reclaim.c when commit_inputs is written before the context is started, but completely misses the identical vulnerability in mm/damon/lru_sort.c. --

--- Patch [1]: [PATCH 1/2] mm/damon/reclaim: skip damon_call() if ctx has not started --- commit d00b612017f41a8bee83736cc54b16dba8d079ff
Author: SJ Park <[email protected]>

mm/damon/reclaim: skip damon_call() if ctx has not started

DAMON_RECLAIM calls damon_call() for commit_inputs parameter user input if the DAMON context is initialized. The context could be initialized, but not yet successfully started. In the case, damon_call() could indefinitely hang. Fix the problem by memorizing if the DAMON context has ever successfully started, and skip damon_call() if it has not.

Quoted 4 lines

mm/damon/reclaim.c +0 -0
index 09e941d75f67d..45d5557cc575a 100644

[ ... ]

Quoted 4 lines

mm/damon/reclaim.c +0 -0

@@ -291,11 +293,8 @@ static int damon_reclaim_commit_inputs_store(const char *val,
 	if (!commit_inputs_request)
 		return 0;

mm/damon/reclaim.c static int damon_reclaim_commit_inputs_store(const char *val, · line 300

Quoted 10 lines

mm/damon/reclaim.c +2 -5

-	/*
-	 * Skip damon_call() if ctx is not initialized to avoid
-	 * NULL pointer dereference.
-	 */
-	if (!ctx)
+	/* Skip damon_call() if ctx has not successfully started. */
+	if (!damon_reclaim_damon_has_started)
 		return -EINVAL;
 
 	err = damon_call(ctx, &control);

[Severity: Medium]
This is a pre-existing issue and was not introduced by the patch under review, but does mm/damon/lru_sort.c also need this same fix?

Looking at damon_lru_sort_commit_inputs_store() in mm/damon/lru_sort.c, it retains the identical vulnerable logic that was patched here in reclaim.c:

mm/damon/lru_sort.c:damon_lru_sort_commit_inputs_store() {
    ...
        /*
         * Skip damon_call() if ctx is not initialized to avoid
         * NULL pointer dereference.
         */
        if (!ctx)
                return -EINVAL;

        err = damon_call(ctx, &control);
    ...
}

If a user writes 'Y' to /sys/module/damon_lru_sort/parameters/commit_inputs before the damon_lru_sort module has been turned on for the first time, damon_call() is invoked before the kdamond thread has been created. Will this cause the caller to hang indefinitely in wait_for_completion() just like the reclaim.c version did?

Should a similar damon_lru_sort_damon_has_started flag be tracked in damon_lru_sort_turn() to fix this in lru_sort.c as well?

Signature · 1 line

Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1

SJ Park

author maintainer

2026-08-03 14:19 UTC #3 lore raw

Re: [PATCH 1/2] mm/damon/reclaim: skip damon_call() if ctx has not started

Quoted 58 lines · On Mon, 03 Aug 2026 14:06:41 +0000 [email protected] wrote:

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues:
- [Medium] The patch fixes an indefinite hang in mm/damon/reclaim.c when commit_inputs is written before the context is started, but completely misses the identical vulnerability in mm/damon/lru_sort.c. --
--- Patch [1]: [PATCH 1/2] mm/damon/reclaim: skip damon_call() if ctx has not started --- commit d00b612017f41a8bee83736cc54b16dba8d079ff
Author: SJ Park <[email protected]>
mm/damon/reclaim: skip damon_call() if ctx has not started
DAMON_RECLAIM calls damon_call() for commit_inputs parameter user input if the DAMON context is initialized. The context could be initialized, but not yet successfully started. In the case, damon_call() could indefinitely hang. Fix the problem by memorizing if the DAMON context has ever successfully started, and skip damon_call() if it has not.
Quoted 4 lines
mm/damon/reclaim.c +0 -0
index 09e941d75f67d..45d5557cc575a 100644
[ ... ]
Quoted 4 lines
mm/damon/reclaim.c +0 -0
@@ -291,11 +293,8 @@ static int damon_reclaim_commit_inputs_store(const char *val,
 	if (!commit_inputs_request)
 		return 0;
 
mm/damon/reclaim.c static int damon_reclaim_commit_inputs_store(const char *val, · line 300
Quoted 10 lines
mm/damon/reclaim.c +2 -5
-	/*
-	 * Skip damon_call() if ctx is not initialized to avoid
-	 * NULL pointer dereference.
-	 */
-	if (!ctx)
+	/* Skip damon_call() if ctx has not successfully started. */
+	if (!damon_reclaim_damon_has_started)
 		return -EINVAL;
 
 	err = damon_call(ctx, &control);
[Severity: Medium]
This is a pre-existing issue and was not introduced by the patch under review, but does mm/damon/lru_sort.c also need this same fix?
Looking at damon_lru_sort_commit_inputs_store() in mm/damon/lru_sort.c, it retains the identical vulnerable logic that was patched here in reclaim.c:
mm/damon/lru_sort.c:damon_lru_sort_commit_inputs_store() {
    ...
        /*
         * Skip damon_call() if ctx is not initialized to avoid
         * NULL pointer dereference.
         */
        if (!ctx)
                return -EINVAL;

        err = damon_call(ctx, &control);
    ...
}

Quoted 8 lines

If a user writes 'Y' to /sys/module/damon_lru_sort/parameters/commit_inputs before the damon_lru_sort module has been turned on for the first time, damon_call() is invoked before the kdamond thread has been created. Will this cause the caller to hang indefinitely in wait_for_completion() just like the reclaim.c version did?
Should a similar damon_lru_sort_damon_has_started flag be tracked in damon_lru_sort_turn() to fix this in lru_sort.c as well?

The next patch of this series fixes the bug.

Quoted 3 lines

Signature · 2 lines

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1

Thanks,
SJ

SJ Park

author maintainer

2026-08-03 13:46 UTC #4 lore raw

PATCH 2/2 mm/damon/lru_sort: skip damon_call() if ctx has not started

In reply to SJ Park

DAMON_LRU_SORT calls damon_call() for commit_inputs parameter user input if the DAMON context is initialized. The context could be initialized, but not yet successfully started. In the case, damon_call() could indefinitely hang. Read the comment on damon_call() for more detail. Fix the problem by memorizing if the DAMON context has ever successfully started, and skip damon_call() if it has not.

This issue can easily be reproduced by writing Y to the commit_inputs parameter file on a system that DAMON_LRU_SORT has not turned on before.

Fixes de3c60e1c831 ("mm/damon: add synchronous commit for commit_inputs")

Cc <[email protected]> # 7.2.x

Signed-off-by SJ Park <[email protected]>

---
 mm/damon/lru_sort.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

mm/damon/lru_sort.c +6 -5

index 3920d5042f109..bd847829a9907 100644
@@ -346,6 +346,8 @@ static int damon_lru_sort_commit_inputs_fn(void *arg)
 	return damon_lru_sort_apply_parameters();
 }
 
+static bool damon_lru_sort_damon_has_started;
+
 static int damon_lru_sort_commit_inputs_store(const char *val,
 					      const struct kernel_param *kp)
 {

@@ -366,11 +368,8 @@ static int damon_lru_sort_commit_inputs_store(const char *val,
 	if (!commit_inputs_request)
 		return 0;
 
-	/*
-	 * Skip damon_call() if ctx is not initialized to avoid
-	 * NULL pointer dereference.
-	 */
-	if (!ctx)
+	/* Skip damon_call() if ctx has not successfully started. */
+	if (!damon_lru_sort_damon_has_started)
 		return -EINVAL;
 
 	err = damon_call(ctx, &control);

@@ -423,6 +422,8 @@ static int damon_lru_sort_turn(bool on)
 	err = damon_start(&ctx, 1, true);
 	if (err)
 		return err;
+	if (!damon_lru_sort_damon_has_started)
+		damon_lru_sort_damon_has_started = true;
 	return damon_call(ctx, &call_control);
 }

Signature · 1 line

2.47.3