mm/damon/sysfs: fix pid leaks from wrong error handlings

DAMON sysfs interface can leak pids due to wrong error handlings. The issue in the mainline has been fixed with code refactoring. The refactoring is done with commits including 7114bc5e01cf ("mm/damon/core:
add cleanup_target() ops callback"). Porting all the refactoring
changes to old stable kernels will be challenging. Hence submitting this non-mainline hotfix series.

SJ Park (2):
mm/damon/sysfs: put target pids for damon_start() failure mm/damon/sysfs: put target pids for apply_inputs() failure

 mm/damon/sysfs.c | 2 ++
 1 file changed, 2 insertions(+)

base-commit: 4d7468bef942db9da779a5960cf42694e84397d6

2.47.3

damon_sysfs_turn_damon_on() allocates and sets up damon_ctx to start. If it is for virtual address space monitoring, the setup increases the reference counts of the target pids. After the setup, the function invokes damon_start(). If damon_start() fails, it deallocates the damon_ctx object without decreasing the reference counts of target pids. As a result, pids can be leaked.

Fix the leak by putting pids using damon_sysfs_destroy_targets() before deallocating the damon_ctx object.

---
 mm/damon/sysfs.c | 1 +
 1 file changed, 1 insertion(+)

index 46980a4bef23a..d95fda1054a00 100644
@@ -1465,6 +1465,7 @@ static int damon_sysfs_turn_damon_on(struct damon_sysfs_kdamond *kdamond)
 		return PTR_ERR(ctx);
 	err = damon_start(&ctx, 1, false);
 	if (err) {
+		damon_sysfs_destroy_targets(ctx);
 		damon_destroy_ctx(ctx);
 		return err;
 	}

2.47.3

damon_sysfs_build_ctx() invokes damon_sysfs_apply_inputs() for setting damon_ctx object with user inputs. If it is configured for virtual address spaces monitoring, the setup also increases reference counts of monitoring target pids. If the setup is failed, damon_sysfs_build_ctx() deallocates the damon_ctx object without decreasing the reference counts of the pids. If the failure happened after increasing reference counts of pids, the pids can be leaked.

Fix the leaks by decreasing the pid reference counts before deallocating the damon_ctx object.

The issue was discovered [1] by Sashiko.

[1] https://lore.kernel.org/[email protected]

---
 mm/damon/sysfs.c | 1 +
 1 file changed, 1 insertion(+)

index d95fda1054a00..f830b873d05fc 100644
@@ -1433,6 +1433,7 @@ static struct damon_ctx *damon_sysfs_build_ctx(
 
 	err = damon_sysfs_apply_inputs(ctx, sys_ctx);
 	if (err) {
+		damon_sysfs_destroy_targets(ctx);
 		damon_destroy_ctx(ctx);
 		return ERR_PTR(err);
 	}

2.47.3