mm/damon/core: fix damon_call() vs kdamond_fn() exit race

Patch series "mm/damon/core: fix damon_call()/damos_walk() vs kdmond exit
race".

damon_call() and damos_walk() can leak memory and/or deadlock when they
race with kdamond terminations.  Fix those.

This patch (of 2);

When kdamond_fn() main loop is finished, the function cancels all
remaining damon_call() requests and unset the damon_ctx->kdamond so that
API callers and API functions themselves can know the context is
terminated.  damon_call() adds the caller's request to the queue first.
After that, it shows if the kdamond of the damon_ctx is still running
(damon_ctx->kdamond is set).  Only if the kdamond is running, damon_call()
starts waiting for the kdamond's handling of the newly added request.

The damon_call() requests registration and damon_ctx->kdamond unset are
protected by different mutexes, though.  Hence, damon_call() could race
with damon_ctx->kdamond unset, and result in deadlocks.

For example, let's suppose kdamond successfully finished the damon_call()
requests cancelling.  Right after that, damon_call() is called for the
context.  It registers the new request, and shows the context is still
running, because damon_ctx->kdamond unset is not yet done.  Hence the
damon_call() caller starts waiting for the handling of the request.
However, the kdamond is already on the termination steps, so it never
handles the new request.  As a result, the damon_call() caller threads
infinitely waits.

Fix this by introducing another damon_ctx field, namely
call_controls_obsolete.  It is protected by the
damon_ctx->call_controls_lock, which protects damon_call() requests
registration.  Initialize (unset) it in kdamond_fn() before letting
damon_start() returns and set it just before the cancelling of remaining
damon_call() requests is executed.  damon_call() reads the obsolete field
under the lock and avoids adding a new request.

After this change, only requests that are guaranteed to be handled or
cancelled are registered.  Hence the after-registration DAMON context
termination check is no longer needed.  Remove it together.

Note that the deadlock will not happen when damon_call() is called for
repeat mode request.  In tis case, damon_call() returns instead of waiting
for the handling when the request registration succeeds and it shows the
kdamond is running.  However, if the request also has dealloc_on_cancel,
the request memory would be leaked.

The issue is found by sashiko [1].

Link: https://lore.kernel.org/20260327233319.3528-1-sj@kernel.org
Link: https://lore.kernel.org/20260327233319.3528-2-sj@kernel.org
Link: https://lore.kernel.org/20260325141956.87144-1-sj@kernel.org
Fixes: 42b7491af14c ("mm/damon/core: introduce damon_call()")
Signed-off-by: SeongJae Park <sj@kernel.org>
Cc: <stable@vger.kernel.org> # 6.14.x
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

diff --git a/include/linux/damon.h b/include/linux/damon.h
index d9a3babbafc167472627531b23766e02cc95a7dd..5129de70e7b70b8e56a320d4962a61fbdb9d0d67 100644 (file)
--- a/include/linux/damon.h
+++ b/include/linux/damon.h
@@ -818,6 +818,7 @@ struct damon_ctx {
 
        /* lists of &struct damon_call_control */
        struct list_head call_controls;
+       bool call_controls_obsolete;
        struct mutex call_controls_lock;
 
        struct damos_walk_control *walk_control;

diff --git a/mm/damon/core.c b/mm/damon/core.c
index db6c67e52d2b86a26e08e58f2e7cf6af64257eaf..9bcda2765ac97fbd011de244b6f921cfdd439cdc 100644 (file)
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -1573,35 +1573,6 @@ int damon_kdamond_pid(struct damon_ctx *ctx)
        return pid;
 }
 
-/*
- * damon_call_handle_inactive_ctx() - handle DAMON call request that added to
- *                                   an inactive context.
- * @ctx:       The inactive DAMON context.
- * @control:   Control variable of the call request.
- *
- * This function is called in a case that @control is added to @ctx but @ctx is
- * not running (inactive).  See if @ctx handled @control or not, and cleanup
- * @control if it was not handled.
- *
- * Returns 0 if @control was handled by @ctx, negative error code otherwise.
- */
-static int damon_call_handle_inactive_ctx(
-               struct damon_ctx *ctx, struct damon_call_control *control)
-{
-       struct damon_call_control *c;
-
-       mutex_lock(&ctx->call_controls_lock);
-       list_for_each_entry(c, &ctx->call_controls, list) {
-               if (c == control) {
-                       list_del(&control->list);
-                       mutex_unlock(&ctx->call_controls_lock);
-                       return -EINVAL;
-               }
-       }
-       mutex_unlock(&ctx->call_controls_lock);
-       return 0;
-}
-
 /**
  * damon_call() - Invoke a given function on DAMON worker thread (kdamond).
  * @ctx:       DAMON context to call the function for.
@@ -1619,6 +1590,10 @@ static int damon_call_handle_inactive_ctx(
  * synchronization.  The return value of the function will be saved in
  * &damon_call_control->return_code.
  *
+ * Note that this function should be called only after damon_start() with the
+ * @ctx has succeeded.  Otherwise, this function could fall into an indefinite
+ * wait.
+ *
  * Return: 0 on success, negative error code otherwise.
  */
 int damon_call(struct damon_ctx *ctx, struct damon_call_control *control)
@@ -1629,10 +1604,12 @@ int damon_call(struct damon_ctx *ctx, struct damon_call_control *control)
        INIT_LIST_HEAD(&control->list);
 
        mutex_lock(&ctx->call_controls_lock);
+       if (ctx->call_controls_obsolete) {
+               mutex_unlock(&ctx->call_controls_lock);
+               return -ECANCELED;
+       }
        list_add_tail(&control->list, &ctx->call_controls);
        mutex_unlock(&ctx->call_controls_lock);
-       if (!damon_is_running(ctx))
-               return damon_call_handle_inactive_ctx(ctx, control);
        if (control->repeat)
                return 0;
        wait_for_completion(&control->completion);
@@ -2952,6 +2929,9 @@ static int kdamond_fn(void *data)
 
        pr_debug("kdamond (%d) starts\n", current->pid);
 
+       mutex_lock(&ctx->call_controls_lock);
+       ctx->call_controls_obsolete = false;
+       mutex_unlock(&ctx->call_controls_lock);
        complete(&ctx->kdamond_started);
        kdamond_init_ctx(ctx);
 
@@ -3062,6 +3042,9 @@ done:
        damon_destroy_targets(ctx);
 
        kfree(ctx->regions_score_histogram);
+       mutex_lock(&ctx->call_controls_lock);
+       ctx->call_controls_obsolete = true;
+       mutex_unlock(&ctx->call_controls_lock);
        kdamond_call(ctx, true);
        damos_walk_cancel(ctx);