Re: [PATCH 5.15.y] mm/damon/core-kunit: check region count before testing in split_at()

[sashiko-bot@kernel.org]

> damon_test_split_at() test next region that is assumed to be created by
> damon_split_region_at() invocation.  But the split might fail.  In this
> case, the succeeding test may dereference invalid pointers returned by
> damon_next_region().
> 
> The invalid pointer may not cause a really bad user impact, because of the
> implementation detail.  It would only read wrong contents in the belonging
> damon_target struct.  Depending on the future change of the offset from
> the link header to the accessing field, this could also be really
> dangerous, though.  Still, the realistic user impact would be limited.  It
> would affect only test run setups.
> 
> Fix it by testing if the number of regions was also changed as expected
> and exit early for the failure.
> 
> The issue was discovered [1] by Sashiko.
> 
> Link: https://lore.kernel.org/20260718001442.87129-3-sj@kernel.org
> Link: https://lore.kernel.org/20260714142352.100478-1-sj@kernel.org [1]
> Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests")
> Signed-off-by: SJ Park <sj@kernel.org>
> Cc: Brendan Higgins <brendan.higgins@linux.dev>
> Cc: <stable@vger.kernel.org> # 5.15.x
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> (cherry picked from commit 9b18ef3c3aa1ce24176e340061caf15fa2742564)
> Signed-off-by: SJ Park <sj@kernel.org>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260909040237.169081-1-sj@kernel.org?part=1