mm/damon/core: remove call_control in inactive contexts

In the Linux kernel, the following vulnerability has been resolved:

mm/damon/core: remove call_control in inactive contexts

If damon_call() is executed against a DAMON context that is not running,

the function returns error while keeping the damon_call_control object

linked to the context's call_controls list. Let's suppose the object is

deallocated after the damon_call(), and yet another damon_call() is

executed against the same context. The function tries to add the new

damon_call_control object to the call_controls list, which still has the

pointer to the previous damon_call_control object, which is deallocated.

As a result, use-after-free happens.

This can actually be triggered using the DAMON sysfs interface. It is not

easily exploitable since it requires the sysfs write permission and making

a definitely weird file writes, though. Please refer to the report for

more details about the issue reproduction steps.

Fix the issue by making two changes. Firstly, move the final

kdamond_call() for cancelling all existing damon_call() requests from

terminating DAMON context to be done before the ctx->kdamond reset. This

makes any code that sees NULL ctx->kdamond can safely assume the context

may not access damon_call() requests anymore. Secondly, let damon_call()

to cleanup the damon_call_control objects that were added to the

already-terminated DAMON context, before returning the error.