FAILED: patch "[PATCH] mm/damon/core-kunit: check region count before testing in" failed to apply to 6.6-stable tree

PATCH Applied [email protected] 4 participants 4 messages Sep 8 – Sep 9

Subsystems (3)

Stable branch Memory management DAMON

lore

Share & tools

lore

[email protected]

author maintainer

2026-09-08 12:56 UTC #0 lore raw

The patch below does not apply to the 6.6-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y
git checkout FETCH_HEAD
git cherry-pick -x 9b18ef3c3aa1ce24176e340061caf15fa2742564
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026090820-attest-sheep-bc32@gregkh' --subject-prefix 'PATCH 6.6.y' 'HEAD^..'

Possible dependencies:

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 9b18ef3c3aa1ce24176e340061caf15fa2742564 Mon Sep 17 00:00:00 2001
From: SJ Park <[email protected]>
Date: Fri, 17 Jul 2026 17:14:36 -0700
Subject: [PATCH] mm/damon/core-kunit: check region count before testing in
split_at()

damon_test_split_at() test next region that is assumed to be created by damon_split_region_at() invocation. But the split might fail. In this case, the succeeding test may dereference invalid pointers returned by damon_next_region().

The invalid pointer may not cause a really bad user impact, because of the implementation detail. It would only read wrong contents in the belonging damon_target struct. Depending on the future change of the offset from the link header to the accessing field, this could also be really dangerous, though. Still, the realistic user impact would be limited. It would affect only test run setups.

Fix it by testing if the number of regions was also changed as expected and exit early for the failure.

The issue was discovered [1] by Sashiko.

Link https://lore.kernel.org/[email protected] open here

Link https://lore.kernel.org/[email protected] [1] open here

Fixes 17ccae8bb5c9 ("mm/damon: add kunit tests")

Signed-off-by SJ Park <[email protected]>

Cc Brendan Higgins <[email protected]>

Cc <[email protected]> # 5.15.x

Signed-off-by Andrew Morton <[email protected]>

mm/damon/tests/core-kunit.h +5 -0

index eba643762132..322a295ac2ce 100644
@@ -155,6 +155,10 @@ static void damon_test_split_at(struct kunit *test)
 	r->age = 10;
 	damon_add_region(r, t);
 	damon_split_region_at(t, r, 25);
+	KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 2);
+	if (damon_nr_regions(t) != 2)
+		goto out;
+
 	KUNIT_EXPECT_EQ(test, r->ar.start, 0ul);
 	KUNIT_EXPECT_EQ(test, r->ar.end, 25ul);

@@ -166,6 +170,7 @@ static void damon_test_split_at(struct kunit *test)
 	KUNIT_EXPECT_EQ(test, r->last_nr_accesses, r_new->last_nr_accesses);
 	KUNIT_EXPECT_EQ(test, r->age, r_new->age);
 
+out:
 	damon_free_target(t);
 }

SJ Park

maintainer

2026-09-09 04:00 UTC #1 lore raw

PATCH 1/1 mm/damon/core-kunit: check region count before testing in split_at()

Fix it by testing if the number of regions was also changed as expected and exit early for the failure.

The issue was discovered [1] by Sashiko.

Link https://lore.kernel.org/[email protected] open here

Link https://lore.kernel.org/[email protected] [1] open here

Fixes 17ccae8bb5c9 ("mm/damon: add kunit tests")

Signed-off-by SJ Park <[email protected]>

Cc Brendan Higgins <[email protected]>

Cc <[email protected]> # 5.15.x

Signed-off-by Andrew Morton <[email protected]>

(cherry picked from commit 9b18ef3c3aa1ce24176e340061caf15fa2742564)

Signed-off-by SJ Park <[email protected]>

---
 mm/damon/core-test.h | 5 +++++
 1 file changed, 5 insertions(+)

mm/damon/core-test.h +5 -0

index a2aa410d6d0d0..f2f0978495086 100644
@@ -162,6 +162,10 @@ static void damon_test_split_at(struct kunit *test)
 	}
 	damon_add_region(r, t);
 	damon_split_region_at(t, r, 25);
+	KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 2);
+	if (damon_nr_regions(t) != 2)
+		goto out;
+
 	KUNIT_EXPECT_EQ(test, r->ar.start, 0ul);
 	KUNIT_EXPECT_EQ(test, r->ar.end, 25ul);

@@ -169,6 +173,7 @@ static void damon_test_split_at(struct kunit *test)
 	KUNIT_EXPECT_EQ(test, r->ar.start, 25ul);
 	KUNIT_EXPECT_EQ(test, r->ar.end, 100ul);
 
+out:
 	damon_free_target(t);
 	damon_destroy_ctx(c);
 }

Signature · 1 line

2.47.3

[email protected]

AI review

2026-09-09 04:13 UTC #2 lore raw

Re: [PATCH 6.6.y] mm/damon/core-kunit: check region count before testing in split_at()

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Medium] The patch addresses an invalid pointer dereference in damon_test_split_at() by checking damon_nr_regions(t) != 2 after a split failure, but misses the exact same vulnerability in damos_test_filter_out(), which will cause a kernel panic if a split fails. --

commit eea94ba78cece48ae60d9049e4528675f25050ea
Author: SJ Park <[email protected]>

mm/damon/core-kunit: check region count before testing in split_at()

The commit addresses an issue in damon_test_split_at() where a failure during region splitting would cause the subsequent code to dereference an invalid pointer. By checking if the region count is 2 after the split, the test now correctly exits early on failure. This fixes a potential memory corruption issue during test execution.

Link https://lore.kernel.org/[email protected] open here

Link https://lore.kernel.org/[email protected] [1] open here

mm/damon/core-test.h static void damon_test_split_at(struct kunit *test) · line 168

Quoted 12 lines

mm/damon/core-test.h +4 -0

index a2aa410d6d0d0..f2f0978495086 100644
@@ -162,6 +162,10 @@ static void damon_test_split_at(struct kunit *test)
 	}
 	damon_add_region(r, t);
 	damon_split_region_at(t, r, 25);
+	KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 2);
+	if (damon_nr_regions(t) != 2)
+		goto out;
+

[Severity: Medium]
This is a pre-existing issue, but does damos_test_filter_out() in the same file suffer from the exact same missing failure check?

If memory allocation fails during region splitting in __damos_filter_out(), damon_nr_regions(t) remains 1. The test code expects 2, but KUNIT_EXPECT_EQ() does not abort execution:

	/* filter should have split the region */
	KUNIT_EXPECT_EQ(test, r->ar.start, DAMON_MIN_REGION * 1);
	KUNIT_EXPECT_EQ(test, r->ar.end, DAMON_MIN_REGION * 2);
	KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 2);
	r2 = damon_next_region(r);
	KUNIT_EXPECT_EQ(test, r2->ar.start, DAMON_MIN_REGION * 2);
	KUNIT_EXPECT_EQ(test, r2->ar.end, DAMON_MIN_REGION * 4);
	damon_destroy_region(r2, t);

Could passing the invalid pointer returned by damon_next_region() to damon_destroy_region() lead to a crash when it executes list_del() and kmem_cache_free() on the corrupted pointer?

A similar pattern also occurs slightly later in the same function:

	/* filter should have split the region */
	KUNIT_EXPECT_EQ(test, r->ar.start, DAMON_MIN_REGION * 2);
	KUNIT_EXPECT_EQ(test, r->ar.end, DAMON_MIN_REGION * 6);
	KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 2);
	r2 = damon_next_region(r);
	KUNIT_EXPECT_EQ(test, r2->ar.start, DAMON_MIN_REGION * 6);
	KUNIT_EXPECT_EQ(test, r2->ar.end, DAMON_MIN_REGION * 8);
	damon_destroy_region(r2, t);

Should similar early exits be added in damos_test_filter_out() to prevent this?

Quoted 11 lines

mm/damon/core-test.h +1 -0

 	KUNIT_EXPECT_EQ(test, r->ar.start, 0ul);
 	KUNIT_EXPECT_EQ(test, r->ar.end, 25ul);

@@ -169,6 +173,7 @@ static void damon_test_split_at(struct kunit *test)
 	KUNIT_EXPECT_EQ(test, r->ar.start, 25ul);
 	KUNIT_EXPECT_EQ(test, r->ar.end, 100ul);
 
+out:
 	damon_free_target(t);
 	damon_destroy_ctx(c);
 }

Signature · 1 line

Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1

Sasha Levin

maintainer Applied

2026-09-09 20:26 UTC #3 lore raw

Re: [PATCH 6.6.y] mm/damon/core-kunit: check region count before testing in split_at()

In reply to SJ Park

Quoted 4 lines

damon_test_split_at() test next region that is assumed to be created by damon_split_region_at() invocation. But the split might fail. In this case, the succeeding test may dereference invalid pointers returned by damon_next_region().

Queued for 6.6, thanks.

Signature · 2 lines

Thanks,
Sasha