From: SJ Park <sj@kernel.org>
Cc: SJ Park <sj@kernel.org>,
stable@vger.kernel.org, Andrew Morton <akpm@linux-foundation.org>,
Brendan Higgins <brendan.higgins@linux.dev>,
David Gow <davidgow@davidgow.net>,
SeongJae Park <sjpark@amazon.de>,
damon@lists.linux.dev, kunit-dev@googlegroups.com,
linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org,
linux-mm@kvack.org
Subject: [PATCH 3/7] mm/damon/vaddr-kunit: check region count in three_regions test
Date: Thu, 16 Jul 2026 17:30:17 -0700 [thread overview]
Message-ID: <20260717003022.119437-4-sj@kernel.org> (raw)
In-Reply-To: <20260717003022.119437-1-sj@kernel.org>
damon_do_test_apply_three_regions() iterates regions after
damon_set_regions() call assuming the function would succeed at setting
the number of regions the same to the expected one. It might have
failed. In this case, __nth_region_of() in the iteration could return
NULL and NULL dereference can happen in the test.
The consequent user impact (NULL dereference) is quite bad. The
realistic user impact would be limited, though. It would affect only
test run setups.
Fix it by testing if the number of regions was also changed as expected
and exit early for the failure.
The issue was discovered [1] by Sashiko.
[1] https://lore.kernel.org/20260713144757.39740-1-sj@kernel.org
Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests")
Cc: <stable@vger.kernel.org> # 5.15.x
Signed-off-by: SJ Park <sj@kernel.org>
---
mm/damon/tests/vaddr-kunit.h | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/mm/damon/tests/vaddr-kunit.h b/mm/damon/tests/vaddr-kunit.h
index 61f844336ffb5..6a95441d193ae 100644
--- a/mm/damon/tests/vaddr-kunit.h
+++ b/mm/damon/tests/vaddr-kunit.h
@@ -158,12 +158,17 @@ static void damon_do_test_apply_three_regions(struct kunit *test,
kunit_skip(test, "second damon_set_regions() fail");
}
+ KUNIT_EXPECT_EQ(test, damon_nr_regions(t), nr_expected / 2);
+ if (damon_nr_regions(t) != nr_expected / 2)
+ goto out;
+
for (i = 0; i < nr_expected / 2; i++) {
r = __nth_region_of(t, i);
KUNIT_EXPECT_EQ(test, r->ar.start, expected[i * 2]);
KUNIT_EXPECT_EQ(test, r->ar.end, expected[i * 2 + 1]);
}
+out:
damon_destroy_target(t, NULL);
}
--
2.47.3
next prev parent reply other threads:[~2026-07-17 0:30 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-17 0:30 [PATCH 0/7] mm/damon: fix uninitialized DAMOS field and kunit exec expectation bugs SJ Park
2026-07-17 0:30 ` [PATCH 1/7] mm/damon/core: initialize damos->last_applied SJ Park
2026-07-17 0:52 ` sashiko-bot
2026-07-17 1:12 ` SJ Park
2026-07-17 0:30 ` [PATCH 2/7] mm/damon/core-kunit: check region count before testing in split_at() SJ Park
2026-07-17 0:44 ` sashiko-bot
2026-07-17 1:18 ` SJ Park
2026-07-17 0:30 ` SJ Park [this message]
2026-07-17 0:30 ` [PATCH 4/7] mm/damon/core-kunit: handle region split failure in filter_out() SJ Park
2026-07-17 0:46 ` sashiko-bot
2026-07-17 1:22 ` SJ Park
2026-07-17 0:30 ` [PATCH 5/7] mm/damon/core-kunit: skip wrong dest walk in commit_dests_for() SJ Park
2026-07-17 0:30 ` [PATCH 6/7] mm/damon/core-kunit: skip wrong quota goal walk in commit_quota_goals() SJ Park
2026-07-17 0:44 ` sashiko-bot
2026-07-17 1:23 ` SJ Park
2026-07-17 0:30 ` [PATCH 7/7] mm/damon/core-kunit: skip wrong region walk in commit_target_regions() SJ Park
2026-07-17 1:05 ` [PATCH 0/7] mm/damon: fix uninitialized DAMOS field and kunit exec expectation bugs SJ Park
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260717003022.119437-4-sj@kernel.org \
--to=sj@kernel.org \
--cc=akpm@linux-foundation.org \
--cc=brendan.higgins@linux.dev \
--cc=damon@lists.linux.dev \
--cc=davidgow@davidgow.net \
--cc=kunit-dev@googlegroups.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=sjpark@amazon.de \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.