FAILED: patch "[PATCH] mm/damon/core-kunit: handle region split failure in" failed to apply to 6.18-stable tree

PATCH New [email protected] 3 participants 3 messages Sep 8 – Sep 9

Subsystems (3)

Stable branch Memory management DAMON

lore

Share & tools

lore

[email protected]

author maintainer

2026-09-08 12:56 UTC #0 lore raw

The patch below does not apply to the 6.18-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.18.y
git checkout FETCH_HEAD
git cherry-pick -x 3423fe70395210e2f0cd795270292f6a27cd57b5
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026090830-think-magical-cf80@gregkh' --subject-prefix 'PATCH 6.18.y' 'HEAD^..'

Possible dependencies:

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 3423fe70395210e2f0cd795270292f6a27cd57b5 Mon Sep 17 00:00:00 2001
From: SJ Park <[email protected]>
Date: Fri, 17 Jul 2026 17:14:38 -0700
Subject: [PATCH] mm/damon/core-kunit: handle region split failure in
filter_out()

damos_test_filter_out() test checks if damos_filter_match() of an address filter splits the region as expected under a given condition. But, the test continued regardless of the split successes. As a result, the later part of the test could dereference invalid pointers that returned from damon_next_region(). Further, it could corrupt memory from damon_destroy_region().

The consequent user impact (memory corruption) is quite bad. The realistic user impact would be limited, though. It would affect only test run setups.

Fix it by exiting early for the number of regions test failure.

The issue was discovered [1] by Sashiko.

Link https://lore.kernel.org/[email protected] open here

Link https://lore.kernel.org/[email protected] [1] open here

Fixes 26713c890875 ("mm/damon/core-test: add a unit test for __damos_filter_out()")

Signed-off-by SJ Park <[email protected]>

Cc Brendan Higgins <[email protected]>

Cc <[email protected]> # 6.6.x

Signed-off-by Andrew Morton <[email protected]>

mm/damon/tests/core-kunit.h +5 -0

index 322a295ac2ce..eddf3a048458 100644
@@ -1365,6 +1365,8 @@ static void damos_test_filter_out(struct kunit *test)
 	KUNIT_EXPECT_EQ(test, r->ar.start, 1);
 	KUNIT_EXPECT_EQ(test, r->ar.end, 2);
 	KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 2);
+	if (damon_nr_regions(t) != 2)
+		goto out;
 	r2 = damon_next_region(r);
 	KUNIT_EXPECT_EQ(test, r2->ar.start, 2);
 	KUNIT_EXPECT_EQ(test, r2->ar.end, 4);

@@ -1379,11 +1381,14 @@ static void damos_test_filter_out(struct kunit *test)
 	KUNIT_EXPECT_EQ(test, r->ar.start, 2);
 	KUNIT_EXPECT_EQ(test, r->ar.end, 6);
 	KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 2);
+	if (damon_nr_regions(t) != 2)
+		goto out;
 	r2 = damon_next_region(r);
 	KUNIT_EXPECT_EQ(test, r2->ar.start, 6);
 	KUNIT_EXPECT_EQ(test, r2->ar.end, 8);
 	damon_destroy_region(r2, t);
 
+out:
 	damon_free_target(t);
 	damos_free_filter(f);
 }

SJ Park

maintainer

2026-09-09 04:04 UTC #1 lore raw

PATCH 1/1 mm/damon/core-kunit: handle region split failure in filter_out()

The consequent user impact (memory corruption) is quite bad. The realistic user impact would be limited, though. It would affect only test run setups.

Fix it by exiting early for the number of regions test failure.

The issue was discovered [1] by Sashiko.

Link https://lore.kernel.org/[email protected] open here

Link https://lore.kernel.org/[email protected] [1] open here

Fixes 26713c890875 ("mm/damon/core-test: add a unit test for __damos_filter_out()")

Signed-off-by SJ Park <[email protected]>

Cc Brendan Higgins <[email protected]>

Cc <[email protected]> # 6.6.x

Signed-off-by Andrew Morton <[email protected]>

(cherry picked from commit 3423fe70395210e2f0cd795270292f6a27cd57b5)

---
 mm/damon/tests/core-kunit.h | 5 +++++
 1 file changed, 5 insertions(+)

mm/damon/tests/core-kunit.h +5 -0

index 6687778752728..801407b481cdc 100644
@@ -588,6 +588,8 @@ static void damos_test_filter_out(struct kunit *test)
 	KUNIT_EXPECT_EQ(test, r->ar.start, DAMON_MIN_REGION * 1);
 	KUNIT_EXPECT_EQ(test, r->ar.end, DAMON_MIN_REGION * 2);
 	KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 2);
+	if (damon_nr_regions(t) != 2)
+		goto out;
 	r2 = damon_next_region(r);
 	KUNIT_EXPECT_EQ(test, r2->ar.start, DAMON_MIN_REGION * 2);
 	KUNIT_EXPECT_EQ(test, r2->ar.end, DAMON_MIN_REGION * 4);

@@ -602,11 +604,14 @@ static void damos_test_filter_out(struct kunit *test)
 	KUNIT_EXPECT_EQ(test, r->ar.start, DAMON_MIN_REGION * 2);
 	KUNIT_EXPECT_EQ(test, r->ar.end, DAMON_MIN_REGION * 6);
 	KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 2);
+	if (damon_nr_regions(t) != 2)
+		goto out;
 	r2 = damon_next_region(r);
 	KUNIT_EXPECT_EQ(test, r2->ar.start, DAMON_MIN_REGION * 6);
 	KUNIT_EXPECT_EQ(test, r2->ar.end, DAMON_MIN_REGION * 8);
 	damon_destroy_region(r2, t);
 
+out:
 	damon_free_target(t);
 	damos_free_filter(f);
 }

Signature · 1 line

2.47.3

[email protected]

AI review

2026-09-09 04:15 UTC #2 lore raw

Re: [PATCH 6.18.y] mm/damon/core-kunit: handle region split failure in filter_out()

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The exact same missing check for region split failure exists in damon_test_split_at(), leading to an out-of-bounds read. --

commit fd822a4546c77b8ec92e7e67206ab99aafb176a1
Author: SJ Park <[email protected]>
Subject: mm/damon/core-kunit: handle region split failure in filter_out()

The damos_test_filter_out() test checks if damos_filter_match() splits a region as expected, but continued regardless of split successes. As a result, the later part of the test could dereference invalid pointers returned from damon_next_region() or corrupt memory from damon_destroy_region(). This commit fixes it by exiting early when the region split fails.

Link https://lore.kernel.org/[email protected] open here

Link https://lore.kernel.org/[email protected] [1] open here

mm/damon/tests/core-kunit.h static void damos_test_filter_out(struct kunit *test) · line 593

Quoted 11 lines

mm/damon/tests/core-kunit.h +2 -0

index 6687778752728..801407b481cdc 100644
@@ -588,6 +588,8 @@ static void damos_test_filter_out(struct kunit *test)
 	KUNIT_EXPECT_EQ(test, r->ar.start, DAMON_MIN_REGION * 1);
 	KUNIT_EXPECT_EQ(test, r->ar.end, DAMON_MIN_REGION * 2);
 	KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 2);
+	if (damon_nr_regions(t) != 2)
+		goto out;
 	r2 = damon_next_region(r);

[Severity: High]
This is a pre-existing issue, but since this patch fixes the missing split verification here, should a similar check be added to damon_test_split_at() in the same file?

In damon_test_split_at(), the code calls damon_split_region_at() and then unconditionally accesses the next region:

	damon_split_region_at(t, r, 25);
	KUNIT_EXPECT_EQ(test, r->ar.start, 0ul);
	KUNIT_EXPECT_EQ(test, r->ar.end, 25ul);

	r_new = damon_next_region(r);
	KUNIT_EXPECT_EQ(test, r_new->ar.start, 25ul);

If the split fails, r remains the only region in the list. Calling damon_next_region(r) would then return an invalid pointer derived from the list head. Dereferencing r_new->ar.start could cause an out-of-bounds read and a potential kernel panic.

Does damon_test_split_at() need an early exit if the split fails to prevent this memory corruption during testing?

Signature · 1 line

Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1