Re: [PATCH 6.18.y] mm/damon/core-kunit: handle region split failure in filter_out()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The exact same missing check for region split failure exists in `damon_test_split_at()`, leading to an out-of-bounds read.
--

commit fd822a4546c77b8ec92e7e67206ab99aafb176a1
Author: SJ Park <sj@kernel.org>
Subject: mm/damon/core-kunit: handle region split failure in filter_out()

The damos_test_filter_out() test checks if damos_filter_match() splits a
region as expected, but continued regardless of split successes. As a
result, the later part of the test could dereference invalid pointers
returned from damon_next_region() or corrupt memory from
damon_destroy_region(). This commit fixes it by exiting early when the
region split fails.

Link: https://lore.kernel.org/20260718001442.87129-5-sj@kernel.org
Link: https://lore.kernel.org/20260714142352.100478-1-sj@kernel.org [1]

> diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h
> index 6687778752728..801407b481cdc 100644
> --- a/mm/damon/tests/core-kunit.h
> +++ b/mm/damon/tests/core-kunit.h
> @@ -588,6 +588,8 @@ static void damos_test_filter_out(struct kunit *test)
>  	KUNIT_EXPECT_EQ(test, r->ar.start, DAMON_MIN_REGION * 1);
>  	KUNIT_EXPECT_EQ(test, r->ar.end, DAMON_MIN_REGION * 2);
>  	KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 2);
> +	if (damon_nr_regions(t) != 2)
> +		goto out;
>  	r2 = damon_next_region(r);

[Severity: High]
This is a pre-existing issue, but since this patch fixes the missing split
verification here, should a similar check be added to damon_test_split_at() in
the same file?

In damon_test_split_at(), the code calls damon_split_region_at() and then
unconditionally accesses the next region:

	damon_split_region_at(t, r, 25);
	KUNIT_EXPECT_EQ(test, r->ar.start, 0ul);
	KUNIT_EXPECT_EQ(test, r->ar.end, 25ul);

	r_new = damon_next_region(r);
	KUNIT_EXPECT_EQ(test, r_new->ar.start, 25ul);

If the split fails, r remains the only region in the list. Calling
damon_next_region(r) would then return an invalid pointer derived from the
list head. Dereferencing r_new->ar.start could cause an out-of-bounds read
and a potential kernel panic.

Does damon_test_split_at() need an early exit if the split fails to prevent
this memory corruption during testing?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260909040431.171803-1-sj@kernel.org?part=1