[PATCH] mm/damon/sysfs-schemes: put damos dests dir after removing its files

[SeongJae Park <sj@kernel.org>]

damon_sysfs_scheme_rm_dirs() puts dests directory kobject before
removing its internal files.  Sincee putting the kobject frees its
container struct, and the internal files removal accesses the container,
use-after-free happens.  Fix it by putting the reference _after_
removing the files.

Reported-by: Alexandre Ghiti <alex@ghiti.fr>
Closes: https://lore.kernel.org/2d39a734-320d-4341-8f8a-4019eec2dbf2@ghiti.fr
Fixes: 2cd0bf85a203 ("mm/damon/sysfs-schemes: implement DAMOS action destinations directory") # 6.17.x
Signed-off-by: SeongJae Park <sj@kernel.org>
---
Not Cc-ing stable@, since the broken commit is in 6.17-rc1 and hence probably
this fix will land on the mainline before the release of the first 6.17 stable
kernel (6.17.1).

 mm/damon/sysfs-schemes.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/damon/sysfs-schemes.c b/mm/damon/sysfs-schemes.c
index 74056bcd6a2c..6536f16006c9 100644
--- a/mm/damon/sysfs-schemes.c
+++ b/mm/damon/sysfs-schemes.c
@@ -2158,8 +2158,8 @@ static void damon_sysfs_scheme_rm_dirs(struct damon_sysfs_scheme *scheme)
 {
 	damon_sysfs_access_pattern_rm_dirs(scheme->access_pattern);
 	kobject_put(&scheme->access_pattern->kobj);
-	kobject_put(&scheme->dests->kobj);
 	damos_sysfs_dests_rm_dirs(scheme->dests);
+	kobject_put(&scheme->dests->kobj);
 	damon_sysfs_quotas_rm_dirs(scheme->quotas);
 	kobject_put(&scheme->quotas->kobj);
 	kobject_put(&scheme->watermarks->kobj);

base-commit: 9aa69ba9d9e220ea1d8ba62592fe7ffba376b2cc
-- 
2.39.5