diff options
| author |   SeongJae Park <sj@kernel.org> | 2025-08-16 09:55:59 -0700 |
|---|---|---|
| committer |   Andrew Morton <akpm@linux-foundation.org> | 2025-08-19 16:35:57 -0700 |
| commit | ba1dd7ac735d604249f1e614d997dc66b30844ab (patch) | |
| tree | e21952d55eae8abd8b78427163f95f509515e28b | |
| parent | mm/migrate: fix NULL movable_ops if CONFIG_ZSMALLOC=m (diff) | |
| download | wireguard-linux-ba1dd7ac735d604249f1e614d997dc66b30844ab.tar.xz wireguard-linux-ba1dd7ac735d604249f1e614d997dc66b30844ab.zip | |
mm/damon/sysfs-schemes: put damos dests dir after removing its files
damon_sysfs_scheme_rm_dirs() puts dests directory kobject before removing
its internal files. Sincee putting the kobject frees its container
struct, and the internal files removal accesses the container,
use-after-free happens. Fix it by putting the reference _after_ removing
the files.
Link: https://lkml.kernel.org/r/20250816165559.2601-1-sj@kernel.org
Fixes: 2cd0bf85a203 ("mm/damon/sysfs-schemes: implement DAMOS action destinations directory")
Signed-off-by: SeongJae Park <sj@kernel.org>
Reported-by: Alexandre Ghiti <alex@ghiti.fr>
Closes: https://lore.kernel.org/2d39a734-320d-4341-8f8a-4019eec2dbf2@ghiti.fr
Tested-by: Alexandre Ghiti <alexghiti@rivosinc.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
| -rw-r--r-- | mm/damon/sysfs-schemes.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/mm/damon/sysfs-schemes.c b/mm/damon/sysfs-schemes.c index 74056bcd6a2c..6536f16006c9 100644 --- a/mm/damon/sysfs-schemes.c +++ b/mm/damon/sysfs-schemes.c @@ -2158,8 +2158,8 @@ static void damon_sysfs_scheme_rm_dirs(struct damon_sysfs_scheme *scheme) { damon_sysfs_access_pattern_rm_dirs(scheme->access_pattern); kobject_put(&scheme->access_pattern->kobj); - kobject_put(&scheme->dests->kobj); damos_sysfs_dests_rm_dirs(scheme->dests); + kobject_put(&scheme->dests->kobj); damon_sysfs_quotas_rm_dirs(scheme->quotas); kobject_put(&scheme->quotas->kobj); kobject_put(&scheme->watermarks->kobj); |