mm/damon/sysfs: fix use-after-free in state_show()

commit 3260a3f0828e06f5f13fac69fb1999a6d60d9cff upstream.

state_show() reads kdamond->damon_ctx without holding damon_sysfs_lock.
This allows a use-after-free race:

CPU 0                         CPU 1
-----                         -----
state_show()                  damon_sysfs_turn_damon_on()
ctx = kdamond->damon_ctx;     mutex_lock(&damon_sysfs_lock);
                              damon_destroy_ctx(kdamond->damon_ctx);
                              kdamond->damon_ctx = NULL;
                              mutex_unlock(&damon_sysfs_lock);
damon_is_running(ctx);        /* ctx is freed */
mutex_lock(&ctx->kdamond_lock); /* UAF */

(The race can also occur with damon_sysfs_kdamonds_rm_dirs() and
damon_sysfs_kdamond_release(), which free or replace the context under
damon_sysfs_lock.)

Fix by taking damon_sysfs_lock before dereferencing the context, mirroring
the locking used in pid_show().

The bug has existed since state_show() first accessed kdamond->damon_ctx.

Link: https://lkml.kernel.org/r/20250905101046.2288-1-disclosure@aisle.com
Fixes: a61ea561c871 ("mm/damon/sysfs: link DAMON for virtual address spaces monitoring")
Signed-off-by: Stanislav Fort <disclosure@aisle.com>
Reported-by: Stanislav Fort <disclosure@aisle.com>
Reviewed-by: SeongJae Park <sj@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: SeongJae Park <sj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/mm/damon/sysfs.c b/mm/damon/sysfs.c
index 58145d59881dd847ec3ee4bb7313c553d7f7db99..9ce2abc64de40060ac26b45156619d1f01c1b08c 100644 (file)
--- a/mm/damon/sysfs.c
+++ b/mm/damon/sysfs.c
@@ -1067,14 +1067,18 @@ static ssize_t state_show(struct kobject *kobj, struct kobj_attribute *attr,
 {
        struct damon_sysfs_kdamond *kdamond = container_of(kobj,
                        struct damon_sysfs_kdamond, kobj);
-       struct damon_ctx *ctx = kdamond->damon_ctx;
-       bool running;
+       struct damon_ctx *ctx;
+       bool running = false;
 
-       if (!ctx)
-               running = false;
-       else
+       if (!mutex_trylock(&damon_sysfs_lock))
+               return -EBUSY;
+
+       ctx = kdamond->damon_ctx;
+       if (ctx)
                running = damon_sysfs_ctx_running(ctx);
 
+       mutex_unlock(&damon_sysfs_lock);
+
        return sysfs_emit(buf, "%s\n", running ?
                        damon_sysfs_cmd_strs[DAMON_SYSFS_CMD_ON] :
                        damon_sysfs_cmd_strs[DAMON_SYSFS_CMD_OFF]);