Re: [PATCH] KVM: selftests: access_tracking_perf_test: bump number of NUMA nodes to 32

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Medium] Incorrect type for `asprintf` return value defeats error checking and causes undefined behavior/crash if allocation fails.
--

commit c131ebf5598f598f5bdd7d212b93b7da852ad82f
Author: Maxim Levitsky <mlevitsk@redhat.com>

KVM: selftests: access_tracking_perf_test: bump number of NUMA nodes to 32

It's rare to find a system that has more than 4 sockets, but a system can
have more than 4 NUMA nodes if each socket exposes its chiplets as separate
NUMA nodes. Bump the limit to 32, just in case.

> diff --git a/tools/testing/selftests/kvm/include/lru_gen_util.h b/tools/testing/selftests/kvm/include/lru_gen_util.h
> index d32ff5d8ffd05..49c8139d398ca 100644
> --- a/tools/testing/selftests/kvm/include/lru_gen_util.h
> +++ b/tools/testing/selftests/kvm/include/lru_gen_util.h
> @@ -14,7 +14,7 @@
>  #include "test_util.h"
>  
>  #define MAX_NR_GENS 16 /* MAX_NR_GENS in include/linux/mmzone.h */
> -#define MAX_NR_NODES 4 /* Maximum number of nodes supported by the test */
> +#define MAX_NR_NODES 32 /* Maximum number of nodes supported by the test */

[Severity: Medium]
This is a pre-existing issue, but does run_aging_impl() in
tools/testing/selftests/kvm/lib/lru_gen_util.c mishandle the return value of
asprintf() when creating the aging command?

tools/testing/selftests/kvm/lib/lru_gen_util.c:run_aging_impl() {
    ...
	FILE *f = fopen(LRU_GEN_DEBUGFS, "w");
	char *command;
	size_t sz;

	TEST_ASSERT(f, "fopen(%s) failed", LRU_GEN_DEBUGFS);
	sz = asprintf(&command, "+ %lu %d %d 1 %d\n",
		      memcg_id, node_id, max_gen, force_scan);
	TEST_ASSERT(sz > 0, "creating aging command failed");
    ...
}

asprintf() returns an int which is -1 on failure. Because it is assigned
to the size_t sz variable, -1 wraps around to SIZE_MAX. The error check
TEST_ASSERT(sz > 0, ...) will incorrectly pass, and the code will then call
fwrite() with an undefined command pointer and SIZE_MAX size, resulting in a
segmentation fault rather than a graceful test failure.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260612150038.1277394-1-mlevitsk@redhat.com?part=1