mm/damon/{reclaim,lru_sort}: handle ctx allocation failures

DAMON_RECLAIM and DAMON_LRU_SORT could dereference NULL pointers if their damon_ctx object allocations fail. The bug is expected to happen not frequently,, because the allocation is arguably too small to fail on common setup. But theoretically it is possible and the consequence is bad. Fix those.

The issue was discovered [1] by Sashiko.

[1] https://lore.kernel.org/[email protected]

Changes from RFC v1
- RFC v1: https://lore.kernel.org/[email protected]
- Drop RFC tag.

SeongJae Park (2):
mm/damon/reclaim: handle ctx allocation failure mm/damonn/lru_sort: handle ctx allocation failure

 mm/damon/lru_sort.c | 4 ++++
 mm/damon/reclaim.c  | 4 ++++
 2 files changed, 8 insertions(+)

base-commit: 62a58b8764d8e485eee4c12d24ee107ef11c98f5

2.47.3

DAMON_RECLAIM allocates the damon_ctx object for its kdamond in its init function. damon_reclaim_enabled_store() wrongly assumes the allocation will always succeed once tried. If the damon_ctx allocation was failed, therefore, code execution reaches to damon_commit_ctx() while 'ctx' is NULL. As a result, it dereferences the NULL 'ctx' pointer. Avoid the NULL dereference by returning -ENOMEM if 'ctx' is NULL.

---
 mm/damon/reclaim.c | 4 ++++
 1 file changed, 4 insertions(+)

index ed446d00ef1cf..ce4499cf4b8b0 100644
@@ -399,6 +399,10 @@ static int damon_reclaim_enabled_store(const char *val,
 	if (!damon_initialized())
 		return 0;
 
+	/* damon_modules_new_paddr_ctx_target() in the init function failed. */
+	if (!ctx)
+		return -ENOMEM;
+
 	return damon_reclaim_turn(enabled);
 }
 

2.47.3

DAMON_LRU_SORT allocates the damon_ctx object for its kdamond in its init function. damon_lru_sort_enabled_store() wrongly assumes the allocation will always succeed once tried. If the damon_ctx allocation was failed, therefore, code execution reaches to damon_commit_ctx() while 'ctx' is NULL. As a result, it dereferences the NULL 'ctx' pointer. Avoid the NULL dereference by returning -ENOMEM if 'ctx' is NULL.

---
 mm/damon/lru_sort.c | 4 ++++
 1 file changed, 4 insertions(+)

index eca88ed941b32..8298c6001fd09 100644
@@ -476,6 +476,10 @@ static int damon_lru_sort_enabled_store(const char *val,
 	if (!damon_initialized())
 		return 0;
 
+	/* damon_modules_new_paddr_ctx_target() in the init function failed. */
+	if (!ctx)
+		return -ENOMEM;
+
 	return damon_lru_sort_turn(enabled);
 }
 

2.47.3