FAILED: patch "[PATCH] mm/damon/tests/core-kunit: catch test failure in" failed to apply to 6.6-stable tree
Subsystems (3)
[email protected]
maintainerThe patch below does not apply to the 6.6-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y
git checkout FETCH_HEAD
git cherry-pick -x b640708929aa956235866bf7717d89018c661083
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026090808-subscript-extortion-d6f9@gregkh' --subject-prefix 'PATCH 6.6.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From b640708929aa956235866bf7717d89018c661083 Mon Sep 17 00:00:00 2001
From: SJ Park <[email protected]>
Date: Tue, 14 Jul 2026 20:09:57 -0700
Subject: [PATCH] mm/damon/tests/core-kunit: catch test failure in
test_merge_regions_of()
KUNIT_EXPECT_EQ() does not abort the execution of test code when the expectation is not met. But damon_test_merge_regions_of() code after its initial KUNIT_EXPECT_EQ() call assumes the expectation is met. It does a per-region test with a hard-coded number of regions that is correct only if the expectation was met. As a result, __nth_region_of() could return NULL, and the test code can dereference NULL pointers. Fix the issue by catching the expectation failure and skip the per-region tests.
The user impact on realistic setups should be negligible, as it is a unit test.
The issue was discovered [1] by Sashiko.
mm/damon/tests/core-kunit.h +3 -0
@@ -260,11 +260,14 @@ static void damon_test_merge_regions_of(struct kunit *test)damon_merge_regions_of (t,9 ,9999 , ctx, true);/* 0-112, 114-130, 130-156, 156-170, 170-230, 230-10170 */ KUNIT_EXPECT_EQ (test,damon_nr_regions (t),6u ); +if (damon_nr_regions (t) !=6 ) + goto out;for (i =0 ; i <6 ; i++) { r =__nth_region_of (t, i);KUNIT_EXPECT_EQ (test, r->ar.start, saddrs[i]);KUNIT_EXPECT_EQ (test, r->ar.end, eaddrs[i]); } +out:damon_free_target (t);damon_destroy_ctx (ctx); }
SJ Park
maintainerPATCH 1/1 mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of()
KUNIT_EXPECT_EQ() does not abort the execution of test code when the expectation is not met. But damon_test_merge_regions_of() code after its initial KUNIT_EXPECT_EQ() call assumes the expectation is met. It does a per-region test with a hard-coded number of regions that is correct only if the expectation was met. As a result, __nth_region_of() could return NULL, and the test code can dereference NULL pointers. Fix the issue by catching the expectation failure and skip the per-region tests.
The user impact on realistic setups should be negligible, as it is a unit test.
The issue was discovered [1] by Sashiko.
--- mm/damon/core-test.h | 3 +++ 1 file changed, 3 insertions(+)
mm/damon/core-test.h +3 -0
@@ -253,11 +253,14 @@ static void damon_test_merge_regions_of(struct kunit *test)damon_merge_regions_of (t,9 ,9999 );/* 0-112, 114-130, 130-156, 156-170 */ KUNIT_EXPECT_EQ (test,damon_nr_regions (t),5u ); +if (damon_nr_regions (t) !=5 ) + goto out;for (i =0 ; i <5 ; i++) { r =__nth_region_of (t, i);KUNIT_EXPECT_EQ (test, r->ar.start, saddrs[i]);KUNIT_EXPECT_EQ (test, r->ar.end, eaddrs[i]); } +out:damon_free_target (t); }
Signature · 1 line
2.47.3
[email protected]
AI reviewRe: [PATCH 6.6.y] mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of()
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues:
- [High] The patch addresses a missing execution abortion on expectation failure in damon_test_merge_regions_of(), but fails to fix identical vulnerabilities in several other test functions where unmet expectations or failed operations lead to invalid memory accesses, out-of-bounds reads, and kernel heap corruption. --
commit 6344f23ed0a644a799bb1ef7adb4c771a412bbdc
Author: SJ Park <[email protected]>
mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of()
KUNIT_EXPECT_EQ() does not abort the execution of test code when the expectation is not met. But damon_test_merge_regions_of() code after its initial KUNIT_EXPECT_EQ() call assumes the expectation is met. Fix the issue by catching the expectation failure and skipping the per-region tests to avoid NULL pointer dereferences.
Quoted 8 lines
mm/damon/core-test.h +0
-0@@ -253,11 +253,14 @@ static void damon_test_merge_regions_of(struct kunit *test)damon_merge_regions_of (t,9 ,9999 );/* 0-112, 114-130, 130-156, 156-170 */ KUNIT_EXPECT_EQ (test,damon_nr_regions (t),5u );
mm/damon/core-test.h static void damon_test_merge_regions_of(struct kunit *test) · line 265
Quoted 10 lines
mm/damon/core-test.h +3
-0+if (damon_nr_regions (t) !=5 ) + goto out;for (i =0 ; i <5 ; i++) { r =__nth_region_of (t, i);KUNIT_EXPECT_EQ (test, r->ar.start, saddrs[i]);KUNIT_EXPECT_EQ (test, r->ar.end, eaddrs[i]); } +out:damon_free_target (t); }
[Severity: High]
This is a pre-existing issue, but this patch addresses the missing execution abort for damon_test_merge_regions_of() while leaving identical issues in other test functions.
In mm/damon/vaddr-test.h:damon_do_test_apply_three_regions():
for (i = 0; i < nr_expected / 2; i++) {
r = __nth_region_of(t, i);
KUNIT_EXPECT_EQ(test, r->ar.start, expected[i * 2]);
KUNIT_EXPECT_EQ(test, r->ar.end, expected[i * 2 + 1]);
}If the target holds fewer regions than nr_expected / 2, could __nth_region_of() return a NULL pointer, leading to a NULL pointer dereference?
In mm/damon/core-test.h:damos_test_filter_out():
KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 2); r2 = damon_next_region(r); KUNIT_EXPECT_EQ(test, r2->ar.start, DAMON_MIN_REGION * 2); KUNIT_EXPECT_EQ(test, r2->ar.end, DAMON_MIN_REGION * 4); damon_destroy_region(r2, t);
If the region split fails, does r remain the last element? If so, would damon_next_region(r) return a pseudo-pointer derived from the list head, causing garbage reads and potentially corrupting the kernel heap during damon_destroy_region()?
There is also a second instance of this in damos_test_filter_out():
KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 2); r2 = damon_next_region(r); KUNIT_EXPECT_EQ(test, r2->ar.start, DAMON_MIN_REGION * 6); KUNIT_EXPECT_EQ(test, r2->ar.end, DAMON_MIN_REGION * 8); damon_destroy_region(r2, t);
Does this second unmet region split expectation also cause a pseudo-pointer to be passed to damon_destroy_region(), crashing the system?
In mm/damon/core-test.h:damon_test_split_at():
r = damon_next_region(r); KUNIT_EXPECT_EQ(test, r->ar.start, 25ul); KUNIT_EXPECT_EQ(test, r->ar.end, 100ul);
If damon_split_region_at() fails silently, does damon_next_region(r) return a pseudo-pointer that is immediately dereferenced, causing an out-of-bounds read?
In mm/damon/core-test.h:damon_test_set_regions():
KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 3);
damon_for_each_region(r, t) {
KUNIT_EXPECT_EQ(test, r->ar.start, expects[expect_idx++]);
KUNIT_EXPECT_EQ(test, r->ar.end, expects[expect_idx++]);
}If damon_nr_regions(t) is unexpectedly greater than 3, will the loop execute more times than the size of the 6-element expects array? Could this cause expect_idx to overrun and trigger an out-of-bounds stack read?
Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1
Re: [PATCH 6.6.y] mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of()
In reply to SJ ParkQuoted 3 lines
KUNIT_EXPECT_EQ()does not abort the execution of test code when the expectation is not met. Butdamon_test_merge_regions_of()code after its initialKUNIT_EXPECT_EQ()call assumes the expectation is met.
Queued for 6.6, thanks.
Signature · 2 lines
Thanks, Sasha