From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EA3AB442FD1; Wed, 9 Sep 2026 13:50:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788961858; cv=none; b=OE2uceJ8miL9ldT+Qo6zY2qYoJB7+z6SuAAZPRxscuYA2YcQR/EeOvhWyYumNkwTXEAwyTCyEIbE6aZbF6AhwOV8SaNqPB0R6uR+rBrXSVGCXZARbkabCD2ildHqHyuOBWLk3U0vz1C78IFCU3ane6VI+foTH4knMnvimPXwBfg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788961858; c=relaxed/simple; bh=rLLxDUVvRX+bQ+ozvDoJKalB3mxCEitCWiQfU8TV+jU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=BruG5yOAoXwtYU5PfXJPGee6nxJK4ctJ2hT3L2P+eFLu6e/CYe2HQib6DwtUSX7cXUhQQU8b/peST85VrkH4gQU0vFuQWBw3TgWOVCc8Poh7LINg28OQpGETxajINpPeAjAfK6w8mxPyYQLAntbCz1hm8yBBBDZGlFRRakp4Uls= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=tM9lxU6p; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="tM9lxU6p" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1407E1F00A3A; Wed, 9 Sep 2026 13:50:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1788961856; bh=i8Gh3BUNw8lEiqojc4Bh0FuasXek62DAwUF2Ttnojr8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=tM9lxU6pakIg9w/mxkftfToADL/9YmfmD/haAXJrWNBN7A67EOy33qA1o7Vcc80os ZiXl07bhIfTx1DD6u6KSaWxws82ASgFIMBKA1xPEf56bylj4JfxBcp+Mzyk01VhSh9 dz0Bru1ejP5eeSEEP6rjEiYExObIV0cUhfb4S0+c= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, SJ Park , Brendan Higgins , Andrew Morton Subject: [PATCH 7.2 091/556] mm/damon/core-kunit: handle region split failure in filter_out() Date: Wed, 9 Sep 2026 15:36:11 +0200 Message-ID: <20260909134233.705310889@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260909134230.441546314@linuxfoundation.org> References: <20260909134230.441546314@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.2-stable review patch. If anyone has any objections, please let me know. ------------------ From: SJ Park commit 3423fe70395210e2f0cd795270292f6a27cd57b5 upstream. damos_test_filter_out() test checks if damos_filter_match() of an address filter splits the region as expected under a given condition. But, the test continued regardless of the split successes. As a result, the later part of the test could dereference invalid pointers that returned from damon_next_region(). Further, it could corrupt memory from damon_destroy_region(). The consequent user impact (memory corruption) is quite bad. The realistic user impact would be limited, though. It would affect only test run setups. Fix it by exiting early for the number of regions test failure. The issue was discovered [1] by Sashiko. Link: https://lore.kernel.org/20260718001442.87129-5-sj@kernel.org Link: https://lore.kernel.org/20260714142352.100478-1-sj@kernel.org [1] Fixes: 26713c890875 ("mm/damon/core-test: add a unit test for __damos_filter_out()") Signed-off-by: SJ Park Cc: Brendan Higgins Cc: # 6.6.x Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman --- mm/damon/tests/core-kunit.h | 5 +++++ 1 file changed, 5 insertions(+) --- a/mm/damon/tests/core-kunit.h +++ b/mm/damon/tests/core-kunit.h @@ -1259,6 +1259,8 @@ static void damos_test_filter_out(struct KUNIT_EXPECT_EQ(test, r->ar.start, 1); KUNIT_EXPECT_EQ(test, r->ar.end, 2); KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 2); + if (damon_nr_regions(t) != 2) + goto out; r2 = damon_next_region(r); KUNIT_EXPECT_EQ(test, r2->ar.start, 2); KUNIT_EXPECT_EQ(test, r2->ar.end, 4); @@ -1273,11 +1275,14 @@ static void damos_test_filter_out(struct KUNIT_EXPECT_EQ(test, r->ar.start, 2); KUNIT_EXPECT_EQ(test, r->ar.end, 6); KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 2); + if (damon_nr_regions(t) != 2) + goto out; r2 = damon_next_region(r); KUNIT_EXPECT_EQ(test, r2->ar.start, 6); KUNIT_EXPECT_EQ(test, r2->ar.end, 8); damon_destroy_region(r2, t); +out: damon_free_target(t); damos_free_filter(f); }