mm/damon/sysfs: fix pid leaks from wrong error handlings

DAMON sysfs interface can leak pids due to wrong error handlings. The issue in the mainline has been fixed with code refactoring. The refactoring is done with commits including 7114bc5e01cf ("mm/damon/core:
add cleanup_target() ops callback"). Porting all the refactoring
changes to old stable kernels will be challenging. Hence submitting this non-mainline hotfix series.

SJ Park (2):
mm/damon/sysfs: put target pids for damon_start() failure mm/damon/sysfs: put target pids for apply_inputs() failure

 mm/damon/sysfs.c | 2 ++
 1 file changed, 2 insertions(+)

base-commit: 969f73b24b91eb0b5042d4d7b26b4bece1f27d18

2.47.3

damon_sysfs_turn_damon_on() allocates and sets up damon_ctx to start. If it is for virtual address space monitoring, the setup increases the reference counts of the target pids. After the setup, the function invokes damon_start(). If damon_start() fails, it deallocates the damon_ctx object without decreasing the reference counts of target pids. As a result, pids can be leaked.

Fix the leak by putting pids using damon_sysfs_destroy_targets() before deallocating the damon_ctx object.

---
 mm/damon/sysfs.c | 1 +
 1 file changed, 1 insertion(+)

index 9a918f8e4c6bf..4b28bb9ba0a24 100644
@@ -2547,6 +2547,7 @@ static int damon_sysfs_turn_damon_on(struct damon_sysfs_kdamond *kdamond)
 		return PTR_ERR(ctx);
 	err = damon_start(&ctx, 1, false);
 	if (err) {
+		damon_sysfs_destroy_targets(ctx);
 		damon_destroy_ctx(ctx);
 		return err;
 	}

2.47.3

damon_sysfs_build_ctx() invokes damon_sysfs_apply_inputs() for setting damon_ctx object with user inputs. If it is configured for virtual address spaces monitoring, the setup also increases reference counts of monitoring target pids. If the setup is failed, damon_sysfs_build_ctx() deallocates the damon_ctx object without decreasing the reference counts of the pids. If the failure happened after increasing reference counts of pids, the pids can be leaked.

Fix the leaks by decreasing the pid reference counts before deallocating the damon_ctx object.

The issue was discovered [1] by Sashiko.

[1] https://lore.kernel.org/[email protected]

---
 mm/damon/sysfs.c | 1 +
 1 file changed, 1 insertion(+)

index 4b28bb9ba0a24..b9b80d58e5bd6 100644
@@ -2515,6 +2515,7 @@ static struct damon_ctx *damon_sysfs_build_ctx(
 
 	err = damon_sysfs_apply_inputs(ctx, sys_ctx);
 	if (err) {
+		damon_sysfs_destroy_targets(ctx);
 		damon_destroy_ctx(ctx);
 		return ERR_PTR(err);
 	}

2.47.3