mm/damon/dbgfs: protect targets destructions with kdamond_lock
authorSeongJae Park <sj@kernel.org>
Sat, 25 Dec 2021 05:12:54 +0000 (21:12 -0800)
committerLinus Torvalds <torvalds@linux-foundation.org>
Sat, 25 Dec 2021 20:20:56 +0000 (12:20 -0800)
commit34796417964b8d0aef45a99cf6c2d20cebe33733
tree580b499bc32555b25e5f8f011409d7a8fe925667
parent595ec1973c276f6c0c1de8aca5eef8dfd81f9b49
mm/damon/dbgfs: protect targets destructions with kdamond_lock

DAMON debugfs interface iterates current monitoring targets in
'dbgfs_target_ids_read()' while holding the corresponding
'kdamond_lock'.  However, it also destructs the monitoring targets in
'dbgfs_before_terminate()' without holding the lock.  This can result in
a use_after_free bug.  This commit avoids the race by protecting the
destruction with the corresponding 'kdamond_lock'.

Link: https://lkml.kernel.org/r/20211221094447.2241-1-sj@kernel.org
Reported-by: Sangwoo Bae <sangwoob@amazon.com>
Fixes: 4bc05954d007 ("mm/damon: implement a debugfs-based user space interface")
Signed-off-by: SeongJae Park <sj@kernel.org>
Cc: <stable@vger.kernel.org> [5.15.x]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
mm/damon/dbgfs.c