FAILED: patch "[PATCH] mm/damon/tests/core-kunit: catch test failure in" failed to apply to 6.1-stable tree
Subsystems (3)
[email protected]
maintainerThe patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x b640708929aa956235866bf7717d89018c661083
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026090809-vice-ribbon-cf5a@gregkh' --subject-prefix 'PATCH 6.1.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From b640708929aa956235866bf7717d89018c661083 Mon Sep 17 00:00:00 2001
From: SJ Park <[email protected]>
Date: Tue, 14 Jul 2026 20:09:57 -0700
Subject: [PATCH] mm/damon/tests/core-kunit: catch test failure in
test_merge_regions_of()
KUNIT_EXPECT_EQ() does not abort the execution of test code when the expectation is not met. But damon_test_merge_regions_of() code after its initial KUNIT_EXPECT_EQ() call assumes the expectation is met. It does a per-region test with a hard-coded number of regions that is correct only if the expectation was met. As a result, __nth_region_of() could return NULL, and the test code can dereference NULL pointers. Fix the issue by catching the expectation failure and skip the per-region tests.
The user impact on realistic setups should be negligible, as it is a unit test.
The issue was discovered [1] by Sashiko.
mm/damon/tests/core-kunit.h +3 -0
@@ -260,11 +260,14 @@ static void damon_test_merge_regions_of(struct kunit *test)damon_merge_regions_of (t,9 ,9999 , ctx, true);/* 0-112, 114-130, 130-156, 156-170, 170-230, 230-10170 */ KUNIT_EXPECT_EQ (test,damon_nr_regions (t),6u ); +if (damon_nr_regions (t) !=6 ) + goto out;for (i =0 ; i <6 ; i++) { r =__nth_region_of (t, i);KUNIT_EXPECT_EQ (test, r->ar.start, saddrs[i]);KUNIT_EXPECT_EQ (test, r->ar.end, eaddrs[i]); } +out:damon_free_target (t);damon_destroy_ctx (ctx); }
SJ Park
maintainerPATCH 1/1 mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of()
KUNIT_EXPECT_EQ() does not abort the execution of test code when the expectation is not met. But damon_test_merge_regions_of() code after its initial KUNIT_EXPECT_EQ() call assumes the expectation is met. It does a per-region test with a hard-coded number of regions that is correct only if the expectation was met. As a result, __nth_region_of() could return NULL, and the test code can dereference NULL pointers. Fix the issue by catching the expectation failure and skip the per-region tests.
The user impact on realistic setups should be negligible, as it is a unit test.
The issue was discovered [1] by Sashiko.
--- mm/damon/core-test.h | 3 +++ 1 file changed, 3 insertions(+)
mm/damon/core-test.h +3 -0
@@ -253,11 +253,14 @@ static void damon_test_merge_regions_of(struct kunit *test)damon_merge_regions_of (t,9 ,9999 );/* 0-112, 114-130, 130-156, 156-170 */ KUNIT_EXPECT_EQ (test,damon_nr_regions (t),5u ); +if (damon_nr_regions (t) !=5 ) + goto out;for (i =0 ; i <5 ; i++) { r =__nth_region_of (t, i);KUNIT_EXPECT_EQ (test, r->ar.start, saddrs[i]);KUNIT_EXPECT_EQ (test, r->ar.end, eaddrs[i]); } +out:damon_free_target (t); }
Signature · 1 line
2.47.3
[email protected]
AI reviewRe: [PATCH 6.1.y] mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of()
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
Pre-existing issues:
- [High] Missing failure check in damon_test_split_at() assumes damon_split_region_at() always succeeds, leading to a heap out-of-bounds read if it fails.
- [High] Missing failure check in damon_test_set_regions() can lead to a stack out-of-bounds array read if damon_set_regions() creates more than 3 regions. --
commit 734d67a5ef8e651363b657168887a0a497532892
Author: SJ Park <[email protected]>
mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of()
KUNIT_EXPECT_EQ() does not abort the execution of test code when the expectation is not met. This commit fixes a potential NULL pointer dereference in damon_test_merge_regions_of() by explicitly checking the number of regions and skipping the per-region test if it doesn't match the expected value. The user impact on realistic setups should be negligible as it is a unit test.
Quoted 8 lines
mm/damon/core-test.h +0
-0@@ -253,11 +253,14 @@ static void damon_test_merge_regions_of(struct kunit *test)damon_merge_regions_of (t,9 ,9999 );/* 0-112, 114-130, 130-156, 156-170 */ KUNIT_EXPECT_EQ (test,damon_nr_regions (t),5u );
mm/damon/core-test.h static void damon_test_merge_regions_of(struct kunit *test) · line 265
Quoted 10 lines
mm/damon/core-test.h +3
-0+if (damon_nr_regions (t) !=5 ) + goto out;for (i =0 ; i <5 ; i++) { r =__nth_region_of (t, i);KUNIT_EXPECT_EQ (test, r->ar.start, saddrs[i]);KUNIT_EXPECT_EQ (test, r->ar.end, eaddrs[i]); } +out:damon_free_target (t); }
[Severity: High]
This isn't a bug introduced by this patch, but since the patch specifically aims to fix missing test-failure aborts, there is a similar missing failure check in damon_test_split_at() that can lead to a heap out-of-bounds read:
mm/damon/core-test.h:damon_test_split_at() {
...
damon_split_region_at(t, r, 25);
KUNIT_EXPECT_EQ(test, r->ar.start, 0ul);
KUNIT_EXPECT_EQ(test, r->ar.end, 25ul);
r = damon_next_region(r);
KUNIT_EXPECT_EQ(test, r->ar.start, 25ul);
...
}If memory allocation fails internally in damon_split_region_at(), the region is not split. KUNIT_EXPECT_EQ() records a failure but does not abort execution.
Will the test unconditionally execute r = damon_next_region(r) in this scenario?
Because the region was not split and remains the only element, damon_next_region() evaluates to an invalid list head pointer. Could dereferencing this to read r->ar.start cause a heap out-of-bounds read?
[Severity: High]
This is a pre-existing issue, but it shares the exact anti-pattern that the patch fixes nearby. Another identical omission exists in damon_test_set_regions():
mm/damon/core-test.h:damon_test_set_regions() {
...
damon_set_regions(t, &range, 1);
KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 3);
damon_for_each_region(r, t) {
KUNIT_EXPECT_EQ(test, r->ar.start, expects[expect_idx++]);
KUNIT_EXPECT_EQ(test, r->ar.end, expects[expect_idx++]);
}
...
}If a logic bug in damon_set_regions() outputs 4 or more regions, the test continues without aborting.
Since the test unconditionally loops over all regions via damon_for_each_region(r, t) and accesses the 6-element static array expects, can this exceed the array bounds?
Would using expects[expect_idx++] twice per loop lead to a stack out-of-bounds read if more than 3 regions exist?
Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1
Re: [PATCH 6.1.y] mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of()
In reply to SJ ParkQuoted 3 lines
KUNIT_EXPECT_EQ()does not abort the execution of test code when the expectation is not met. Butdamon_test_merge_regions_of()code after its initialKUNIT_EXPECT_EQ()call assumes the expectation is met.
Queued for 6.1, thanks.
Signature · 2 lines
Thanks, Sasha