Re: [PATCH 6.1.y] mm/damon/core-kunit: check region count before testing in split_at()

[SJ Park <sj@kernel.org>]

On Tue,  8 Sep 2026 20:58:13 -0700 SJ Park <sj@kernel.org> wrote:

> damon_test_split_at() test next region that is assumed to be created by
> damon_split_region_at() invocation.  But the split might fail.  In this
> case, the succeeding test may dereference invalid pointers returned by
> damon_next_region().
> 
> The invalid pointer may not cause a really bad user impact, because of the
> implementation detail.  It would only read wrong contents in the belonging
> damon_target struct.  Depending on the future change of the offset from
> the link header to the accessing field, this could also be really
> dangerous, though.  Still, the realistic user impact would be limited.  It
> would affect only test run setups.
> 
> Fix it by testing if the number of regions was also changed as expected
> and exit early for the failure.
> 
> The issue was discovered [1] by Sashiko.
> 
> Link: https://lore.kernel.org/20260718001442.87129-3-sj@kernel.org
> Link: https://lore.kernel.org/20260714142352.100478-1-sj@kernel.org [1]
> Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests")
> Signed-off-by: SJ Park <sj@kernel.org>
> Cc: Brendan Higgins <brendan.higgins@linux.dev>
> Cc: <stable@vger.kernel.org> # 5.15.x
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> (cherry picked from commit 9b18ef3c3aa1ce24176e340061caf15fa2742564)
> Signed-off-by: SJ Park <sj@kernel.org>
> ---
>  mm/damon/core-test.h | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/mm/damon/core-test.h b/mm/damon/core-test.h
> index d8fef225930a5..1dd17d43a642c 100644
> --- a/mm/damon/core-test.h
> +++ b/mm/damon/core-test.h
> @@ -162,6 +162,9 @@ static void damon_test_split_at(struct kunit *test)
>  	}
>  	damon_add_region(r, t);
>  	damon_split_region_at(t, r, 25);
> +	KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 2);
> +	if (!damon_nr_regions(t) != 2)
> +		goto out;

Sashiko found the above if condition has a typo.  It should 's/!damon/damon/'.
Please ignore this patch.  I will send a corrected patch as another reply.

>  	KUNIT_EXPECT_EQ(test, r->ar.start, 0ul);
>  	KUNIT_EXPECT_EQ(test, r->ar.end, 25ul);
>  
> @@ -169,6 +172,7 @@ static void damon_test_split_at(struct kunit *test)
>  	KUNIT_EXPECT_EQ(test, r->ar.start, 25ul);
>  	KUNIT_EXPECT_EQ(test, r->ar.end, 100ul);
>  
> +out:
>  	damon_free_target(t);
>  	damon_destroy_ctx(c);
>  }
> -- 
> 2.47.3
> 
> 


Thanks,
SJ