FAILED: patch "[PATCH] mm/damon/core-kunit: check region count before testing in" failed to apply to 6.1-stable tree
Subsystems (3)
[email protected]
maintainerThe patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x 9b18ef3c3aa1ce24176e340061caf15fa2742564
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026090820-envoy-endanger-c99b@gregkh' --subject-prefix 'PATCH 6.1.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 9b18ef3c3aa1ce24176e340061caf15fa2742564 Mon Sep 17 00:00:00 2001
From: SJ Park <[email protected]>
Date: Fri, 17 Jul 2026 17:14:36 -0700
Subject: [PATCH] mm/damon/core-kunit: check region count before testing in
split_at()
damon_test_split_at() test next region that is assumed to be created by damon_split_region_at() invocation. But the split might fail. In this case, the succeeding test may dereference invalid pointers returned by damon_next_region().
The invalid pointer may not cause a really bad user impact, because of the implementation detail. It would only read wrong contents in the belonging damon_target struct. Depending on the future change of the offset from the link header to the accessing field, this could also be really dangerous, though. Still, the realistic user impact would be limited. It would affect only test run setups.
Fix it by testing if the number of regions was also changed as expected and exit early for the failure.
The issue was discovered [1] by Sashiko.
mm/damon/tests/core-kunit.h +5 -0
@@ -155,6 +155,10 @@ static void damon_test_split_at(struct kunit *test) r->age =10 ;damon_add_region (r, t);damon_split_region_at (t, r,25 ); +KUNIT_EXPECT_EQ (test,damon_nr_regions (t),2 ); +if (damon_nr_regions (t) !=2 ) + goto out; +KUNIT_EXPECT_EQ (test, r->ar.start,0ul );KUNIT_EXPECT_EQ (test, r->ar.end,25ul );
@@ -166,6 +170,7 @@ static void damon_test_split_at(struct kunit *test)KUNIT_EXPECT_EQ (test, r->last_nr_accesses, r_new->last_nr_accesses);KUNIT_EXPECT_EQ (test, r->age, r_new->age); +out:damon_free_target (t); }
SJ Park
maintainerPATCH 1/1 mm/damon/core-kunit: check region count before testing in split_at()
damon_test_split_at() test next region that is assumed to be created by damon_split_region_at() invocation. But the split might fail. In this case, the succeeding test may dereference invalid pointers returned by damon_next_region().
The invalid pointer may not cause a really bad user impact, because of the implementation detail. It would only read wrong contents in the belonging damon_target struct. Depending on the future change of the offset from the link header to the accessing field, this could also be really dangerous, though. Still, the realistic user impact would be limited. It would affect only test run setups.
Fix it by testing if the number of regions was also changed as expected and exit early for the failure.
The issue was discovered [1] by Sashiko.
--- mm/damon/core-test.h | 4 ++++ 1 file changed, 4 insertions(+)
mm/damon/core-test.h +4 -0
@@ -162,6 +162,9 @@ static void damon_test_split_at(struct kunit *test) }damon_add_region (r, t);damon_split_region_at (t, r,25 ); +KUNIT_EXPECT_EQ (test,damon_nr_regions (t),2 ); +if (!damon_nr_regions (t) !=2 ) + goto out;KUNIT_EXPECT_EQ (test, r->ar.start,0ul );KUNIT_EXPECT_EQ (test, r->ar.end,25ul );
@@ -169,6 +172,7 @@ static void damon_test_split_at(struct kunit *test)KUNIT_EXPECT_EQ (test, r->ar.start,25ul );KUNIT_EXPECT_EQ (test, r->ar.end,100ul ); +out:damon_free_target (t);damon_destroy_ctx (c); }
Signature · 1 line
2.47.3
[email protected]
AI reviewRe: [PATCH 6.1.y] mm/damon/core-kunit: check region count before testing in split_at()
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Medium] The error-checking condition `!damon_nr_regions(t) != 2` is always true due to operator…
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The error-checking condition !damon_nr_regions(t) != 2 is always true due to operator precedence, causing the test to unconditionally skip its core assertions. --
commit 6fefc501724f8572d4bbc1782d2ab55fa7568e21
Author: SJ Park <[email protected]>
mm/damon/core-kunit: check region count before testing in split_at()
This patch updates damon_test_split_at() to verify the region count was successfully changed before proceeding. This prevents invalid pointer dereferences if the split fails.
mm/damon/core-test.h static void damon_test_split_at(struct kunit *test) · line 167
Quoted 11 lines
mm/damon/core-test.h +3
-0@@ -162,6 +162,9 @@ static void damon_test_split_at(struct kunit *test) }damon_add_region (r, t);damon_split_region_at (t, r,25 ); +KUNIT_EXPECT_EQ (test,damon_nr_regions (t),2 ); +if (!damon_nr_regions (t) !=2 ) + goto out;
[Severity: Medium]
Will this error-checking condition unintentionally skip the core assertions of the test?
Because of operator precedence, !damon_nr_regions(t) evaluates to either 0 or 1. Neither 0 nor 1 equals 2, meaning the inequality (!= 2) is always true.
This seems to force the test to unconditionally take the goto out path, bypassing the boundary validations it is designed to perform.
Quoted 2 lines
mm/damon/core-test.h +0
-0KUNIT_EXPECT_EQ (test, r->ar.start,0ul );KUNIT_EXPECT_EQ (test, r->ar.end,25ul );
Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1
SJ Park
maintainerRe: [PATCH 6.1.y] mm/damon/core-kunit: check region count before testing in split_at()
Quoted 32 lines · On Wed, 09 Sep 2026 04:02:48 +0000 [email protected] wrote:
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The error-checking condition!damon_nr_regions(t) != 2is always true due to operator precedence, causing the test to unconditionally skip its core assertions. --commit
6fefc501724f8572d4bbc1782d2ab55fa7568e21
Author: SJ Park <[email protected]>
mm/damon/core-kunit: check region count before testing insplit_at()This patch updates
damon_test_split_at()to verify the region count was successfully changed before proceeding. This prevents invalid pointer dereferences if the split fails.mm/damon/core-test.h static void damon_test_split_at(struct kunit *test) · line 167
Quoted 11 lines
mm/damon/core-test.h +3
-0@@ -162,6 +162,9 @@ static void damon_test_split_at(struct kunit *test) }damon_add_region (r, t);damon_split_region_at (t, r,25 ); +KUNIT_EXPECT_EQ (test,damon_nr_regions (t),2 ); +if (!damon_nr_regions (t) !=2 ) + goto out;[Severity: Medium]
Will this error-checking condition unintentionally skip the core assertions of the test?
Quoted 5 lines
Because of operator precedence, !damon_nr_regions(t) evaluates to either 0 or 1. Neither 0 nor 1 equals 2, meaning the inequality (!= 2) is always true.
This seems to force the test to unconditionally take the goto out path, bypassing the boundary validations it is designed to perform.
Nice finding, it was a typo. I will fix.
Quoted 7 lines
Quoted 3 lines
mm/damon/core-test.h +0
-0KUNIT_EXPECT_EQ (test, r->ar.start,0ul );KUNIT_EXPECT_EQ (test, r->ar.end,25ul );Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1
Thanks,
SJ
SJ Park
maintainerRe: [PATCH 6.1.y] mm/damon/core-kunit: check region count before testing in split_at()
In reply to SJ ParkQuoted 35 lines · On Tue, 8 Sep 2026 20:58:13 -0700 SJ Park <[email protected]> wrote:
damon_test_split_at()test next region that is assumed to be created bydamon_split_region_at()invocation. But the split might fail. In this case, the succeeding test may dereference invalid pointers returned bydamon_next_region().The invalid pointer may not cause a really bad user impact, because of the implementation detail. It would only read wrong contents in the belonging
damon_targetstruct. Depending on the future change of the offset from the link header to the accessing field, this could also be really dangerous, though. Still, the realistic user impact would be limited. It would affect only test run setups.Fix it by testing if the number of regions was also changed as expected and exit early for the failure.
The issue was discovered [1] by Sashiko.
Fixes 17ccae8bb5c9 ("mm/damon: add kunit tests")Signed-off-by SJ Park <[email protected]>Cc Brendan Higgins <[email protected]>Cc <[email protected]> # 5.15.xSigned-off-by Andrew Morton <[email protected]>(cherry picked from commit 9b18ef3c3aa1ce24176e340061caf15fa2742564)Signed-off-by SJ Park <[email protected]>--- mm/damon/core-test.h | 4 ++++ 1 file changed, 4 insertions(+)mm/damon/core-test.h +0
-0
mm/damon/core-test.h static void damon_test_split_at(struct kunit *test) · line 167
Quoted 6 lines
mm/damon/core-test.h +3
-0@@ -162,6 +162,9 @@ static void damon_test_split_at(struct kunit *test) }damon_add_region (r, t);damon_split_region_at (t, r,25 ); +KUNIT_EXPECT_EQ (test,damon_nr_regions (t),2 ); +if (!damon_nr_regions (t) !=2 ) + goto out;
Sashiko found the above if condition has a typo. It should 's/!damon/damon/'. Please ignore this patch. I will send a corrected patch as another reply.
Quoted 15 lines
mm/damon/core-test.h +1
-0KUNIT_EXPECT_EQ (test, r->ar.start,0ul );KUNIT_EXPECT_EQ (test, r->ar.end,25ul );@@ -169,6 +172,7 @@ static void damon_test_split_at(struct kunit *test)KUNIT_EXPECT_EQ (test, r->ar.start,25ul );KUNIT_EXPECT_EQ (test, r->ar.end,100ul ); +out:damon_free_target (t);damon_destroy_ctx (c); }Signature · 1 line
2.47.3
Thanks,
SJ
SJ Park
maintainerPATCH 1/1 mm/damon/core-kunit: check region count before testing in split_at()
In reply to [email protected]damon_test_split_at() test next region that is assumed to be created by damon_split_region_at() invocation. But the split might fail. In this case, the succeeding test may dereference invalid pointers returned by damon_next_region().
The invalid pointer may not cause a really bad user impact, because of the implementation detail. It would only read wrong contents in the belonging damon_target struct. Depending on the future change of the offset from the link header to the accessing field, this could also be really dangerous, though. Still, the realistic user impact would be limited. It would affect only test run setups.
Fix it by testing if the number of regions was also changed as expected and exit early for the failure.
The issue was discovered [1] by Sashiko.
--- mm/damon/core-test.h | 4 ++++ 1 file changed, 4 insertions(+)
mm/damon/core-test.h +4 -0
@@ -162,6 +162,9 @@ static void damon_test_split_at(struct kunit *test) }damon_add_region (r, t);damon_split_region_at (t, r,25 ); +KUNIT_EXPECT_EQ (test,damon_nr_regions (t),2 ); +if (damon_nr_regions (t) !=2 ) + goto out;KUNIT_EXPECT_EQ (test, r->ar.start,0ul );KUNIT_EXPECT_EQ (test, r->ar.end,25ul );
@@ -169,6 +172,7 @@ static void damon_test_split_at(struct kunit *test)KUNIT_EXPECT_EQ (test, r->ar.start,25ul );KUNIT_EXPECT_EQ (test, r->ar.end,100ul ); +out:damon_free_target (t);damon_destroy_ctx (c); }
Signature · 1 line
2.47.3
[email protected]
AI reviewRe: [PATCH 6.1.y] mm/damon/core-kunit: check region count before testing in split_at()
Sashiko has reviewed this patch and found no issues. It looks great!
Quoted 17 lines
damon_test_split_at()test next region that is assumed to be created bydamon_split_region_at()invocation. But the split might fail. In this case, the succeeding test may dereference invalid pointers returned bydamon_next_region().The invalid pointer may not cause a really bad user impact, because of the implementation detail. It would only read wrong contents in the belonging
damon_targetstruct. Depending on the future change of the offset from the link header to the accessing field, this could also be really dangerous, though. Still, the realistic user impact would be limited. It would affect only test run setups.Fix it by testing if the number of regions was also changed as expected and exit early for the failure.
The issue was discovered [1] by Sashiko.
Quoted 9 lines
Fixes 17ccae8bb5c9 ("mm/damon: add kunit tests")Signed-off-by SJ Park <[email protected]>Cc Brendan Higgins <[email protected]>Cc <[email protected]> # 5.15.xSigned-off-by Andrew Morton <[email protected]>(cherry picked from commit 9b18ef3c3aa1ce24176e340061caf15fa2742564)Signed-off-by SJ Park <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great!
Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1
Re: [PATCH 6.1.y] mm/damon/core-kunit: check region count before testing in split_at()
In reply to SJ ParkQuoted 4 lines
damon_test_split_at()test next region that is assumed to be created bydamon_split_region_at()invocation. But the split might fail. In this case, the succeeding test may dereference invalid pointers returned bydamon_next_region().
Queued for 6.1, thanks.
Signature · 2 lines
Thanks, Sasha