2022-10-02 20:02:07

by SeongJae Park

Subject: [PATCH] mm/damon/core: initialize damon_target->list in damon_new_target()

'struct damon_target' creation function, 'damon_new_target()' is not
initializing its '->list' field, unlike other DAMON structs creator
functions such as 'damon_new_region()'. Normal users of
'damon_new_target()' initializes the field by adding the target to DAMON
context's targets list, but some code could access the uninitialized
field.

This commit avoids the case by initializing the field in
'damon_new_target()'.

Reported-by: Hyeonggon Yoo <[email protected]>
Fixes: f23b8eee1871 ("mm/damon/core: implement region-based sampling")
Signed-off-by: SeongJae Park <[email protected]>
---

mm/damon/core.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/mm/damon/core.c b/mm/damon/core.c
index 1d952fa7ba3e..1e6691771a95 100644
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -345,6 +345,7 @@ struct damon_target *damon_new_target(void)
t->pid = NULL;
t->nr_regions = 0;
INIT_LIST_HEAD(&t->regions_list);
+ INIT_LIST_HEAD(&t->list);

return t;
}
--
2.25.1

2022-10-03 06:43:05

by Hyeonggon Yoo

Subject: Re: [PATCH] mm/damon/core: initialize damon_target->list in damon_new_target()

On Sun, Oct 02, 2022 at 07:31:30PM +0000, SeongJae Park wrote:
> 'struct damon_target' creation function, 'damon_new_target()' is not
> initializing its '->list' field, unlike other DAMON structs creator
> functions such as 'damon_new_region()'. Normal users of
> 'damon_new_target()' initializes the field by adding the target to DAMON
> context's targets list, but some code could access the uninitialized
> field.
>
> This commit avoids the case by initializing the field in
> 'damon_new_target()'.
>
> Reported-by: Hyeonggon Yoo <[email protected]>
> Fixes: f23b8eee1871 ("mm/damon/core: implement region-based sampling")
> Signed-off-by: SeongJae Park <[email protected]>
> ---
>
> mm/damon/core.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/mm/damon/core.c b/mm/damon/core.c
> index 1d952fa7ba3e..1e6691771a95 100644
> --- a/mm/damon/core.c
> +++ b/mm/damon/core.c
> @@ -345,6 +345,7 @@ struct damon_target *damon_new_target(void)
> t->pid = NULL;
> t->nr_regions = 0;
> INIT_LIST_HEAD(&t->regions_list);
> + INIT_LIST_HEAD(&t->list);
>
> return t;
> }

I tried again with it and this fixes the bug I reported.
Tested-by: Hyeonggon Yoo <[email protected]>

Thank you for such a quick fix!

> --
> 2.25.1
>

--
Thanks,
Hyeonggon