mm/damon/core: get memcg reference before access

The commit b74a120bcf507 ("mm/damon/core: implement
DAMOS_QUOTA_NODE_MEMCG_USED_BP") added accesses to memcg structure without
getting reference to it.  This is unsafe.  Let's get the reference before
accessing the memcg.

Link: https://lkml.kernel.org/r/20251225002904.139543-1-shakeel.butt@linux.dev
Fixes: b74a120bcf507 ("mm/damon/core: implement DAMOS_QUOTA_NODE_MEMCG_USED_BP")
Signed-off-by: Shakeel Butt <shakeel.butt@linux.dev>
Reviewed-by: SeongJae Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

diff --git a/mm/damon/core.c b/mm/damon/core.c
index f9fc0375890a808ad8577aad13a5c58ecef48b57..fd09bd106ad5467034f10c29d13e54a1986e2d6d 100644 (file)
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -2051,13 +2051,15 @@ static unsigned long damos_get_node_memcg_used_bp(
 
        rcu_read_lock();
        memcg = mem_cgroup_from_id(goal->memcg_id);
-       rcu_read_unlock();
-       if (!memcg) {
+       if (!memcg || !mem_cgroup_tryget(memcg)) {
+               rcu_read_unlock();
                if (goal->metric == DAMOS_QUOTA_NODE_MEMCG_USED_BP)
                        return 0;
                else    /* DAMOS_QUOTA_NODE_MEMCG_FREE_BP */
                        return 10000;
        }
+       rcu_read_unlock();
+
        mem_cgroup_flush_stats(memcg);
        lruvec = mem_cgroup_lruvec(memcg, NODE_DATA(goal->nid));
        used_pages = lruvec_page_state(lruvec, NR_ACTIVE_ANON);
@@ -2065,6 +2067,8 @@ static unsigned long damos_get_node_memcg_used_bp(
        used_pages += lruvec_page_state(lruvec, NR_ACTIVE_FILE);
        used_pages += lruvec_page_state(lruvec, NR_INACTIVE_FILE);
 
+       mem_cgroup_put(memcg);
+
        si_meminfo_node(&i, goal->nid);
        if (goal->metric == DAMOS_QUOTA_NODE_MEMCG_USED_BP)
                numerator = used_pages;