FAILED: patch "[PATCH] mm/damon/core-kunit: handle region split failure in" failed to apply to 6.12-stable tree

mm/damon/tests/core-kunit.h static void damos_test_filter_out(struct kunit *test) · line 580

[Severity: High]
This isn't a bug introduced by this patch, but does this test miss NULL pointer checks for memory allocations earlier in the same function?

If memory allocation fails (e.g., during KUnit OOM simulation), damos_new_filter(), damon_new_target(), or damon_new_region() will return NULL. The returned pointers f, t, and r are immediately dereferenced without any verification:

mm/damon/tests/core-kunit.h:damos_test_filter_out() {
	f = damos_new_filter(DAMOS_FILTER_TYPE_ADDR, true);
	f->addr_range = (struct damon_addr_range){
		.start = DAMON_MIN_REGION * 2, .end = DAMON_MIN_REGION * 6};

	t = damon_new_target();
	r = damon_new_region(DAMON_MIN_REGION * 3, DAMON_MIN_REGION * 5);
	damon_add_region(r, t);
    ...
}

While this only impacts test environments, KUnit tests should not trigger kernel panics on allocation failures. This is a standard already followed by other tests in the same file which safely use kunit_skip(test, "alloc fail");

[Severity: High]
This is a pre-existing issue, but could this code dereference an invalid pointer upon allocation failure?

damon_split_region_at() silently returns without splitting if damon_new_region() fails to allocate memory. In damon_test_split_at(), if the split fails, r remains the last region. damon_next_region(r) will then use container_of() on the list head, returning an invalid pointer outside the bounds of struct damon_target. Dereferencing this pointer reads memory out of bounds:

mm/damon/tests/core-kunit.h:damon_test_split_at() {
    ...
	damon_split_region_at(t, r, 25);
	KUNIT_EXPECT_EQ(test, r->ar.start, 0ul);
	KUNIT_EXPECT_EQ(test, r->ar.end, 25ul);

	r_new = damon_next_region(r);
	KUNIT_EXPECT_EQ(test, r_new->ar.start, 25ul);
    ...
}

This requires an allocation failure during test execution, which is the exact same class of vulnerability that this patch addresses for damos_test_filter_out().

[Severity: High]
This is a pre-existing issue, but could this test trigger a NULL pointer dereference on failure?

The test expects 5 regions to remain after a merge operation. It verifies this with KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 5u);. However, KUNIT_EXPECT_EQ does not abort test execution if the expectation fails. If the merge operation results in fewer than 5 regions, the subsequent loop will call __nth_region_of(t, i) with an out-of-bounds index, returning a NULL pointer. The NULL pointer is then unconditionally dereferenced by r->ar.start:

mm/damon/tests/core-kunit.h:damon_test_merge_regions_of() {
    ...
	damon_merge_regions_of(t, 9, 9999);
	/* 0-112, 114-130, 130-156, 156-170 */
	KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 5u);
	for (i = 0; i < 5; i++) {
		r = __nth_region_of(t, i);
		KUNIT_EXPECT_EQ(test, r->ar.start, saddrs[i]);
    ...
}

Should KUNIT_ASSERT_EQ be used instead of KUNIT_EXPECT_EQ to safely abort the test and prevent the subsequent NULL pointer dereference?

Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1