[PATCH 0/7] Silence spurious warnings and crashes from kunit test suites

[PATCH 0/7] Silence spurious warnings and crashes from kunit test suites

[Jia He]

Running the full kunit suite on arm64 (128-core Neoverse N2) with 7.1-rc3+
produces a handful of backtraces that are not real kernel bugs but
rather test-infrastructure issues: races with boot-time code, missing
bounds checks, resource leaks, and sysfs duplicate-name splats.

This series fixes them one by one so that a clean kunit run no longer
leaves noise in dmesg:

 1. init/initramfs_test races with the async rootfs unpacker; add
    wait_for_initramfs() in suite .init.
 2. kfence kunit cases fail outright when the pool is unavailable;
    skip them instead.
 3. intlog2(0) / intlog10(0) hit a WARN_ON that is harmless; remove it.
 4. kunit_platform_device_add() triggers sysfs_warn_dup() on the
    duplicate-registration test; catch duplicates early in the kunit
    helper (best-effort; final protection remains in driver core/sysfs).
 5. misc_register() likewise hits sysfs_warn_dup(); reject duplicate
    names explicitly. misc->name is never NULL at this point since the
    existing code already dereferences it unconditionally.
 6. hw_breakpoint test_many_cpus overflows its array on machines with
    many cores; bail out at the limit.
 7. test_ratelimit stress test checks the wrong variable for kthread
    creation, leaks memory, and races on doneflag. Use goto-based
    cleanup to guarantee all started threads are stopped on failure.

All patches are independent and can be applied/reviewed separately.
Tested on arm64 Neoverse N2 (128-core arm64) with
CONFIG_KUNIT=y and CONFIG_KUNIT_ALL_TESTS=y.

Jia He (7):
  init/initramfs_test: wait_for_initramfs() before running
  kfence: kunit: skip when no pool is available
  lib/math/int_log: drop WARN_ON for value == 0
  kunit: platform: catch duplicate (name, id) in kunit_platform_device_add()
  misc: reject duplicate names in misc_register()
  hw_breakpoint_test: fix test_many_cpus failure on large systems
  lib/tests: test_ratelimit: fix stress test thread lifecycle and leak

 drivers/char/misc.c                |  22 ++++++++++++++++++
 init/initramfs_test.c              |  17 +++++++++++++-
 kernel/events/hw_breakpoint_test.c |  12 ++++++++++
 lib/kunit/platform.c               |  36 +++++++++++++++++++++++++++++
 lib/math/int_log.c                 |   8 ++-----
 lib/tests/test_ratelimit.c         |  26 ++++++++++++++++-----
 mm/kfence/kfence_test.c            |   6 +++--
 7 files changed, 115 insertions(+), 12 deletions(-)

[PATCH 1/7] init/initramfs_test: wait_for_initramfs() before running

[Jia He]

initramfs_test_extract() and friends call unpack_to_rootfs() from a
kunit kthread while do_populate_rootfs() may still be running
asynchronously from rootfs_initcall. unpack_to_rootfs() keeps its
parser state in module-static variables (victim, byte_count, state,
this_header, header_buf, name_buf, ...), so the two writers corrupt
each other.

On arm64 v7.0-rc5+ this oopses early in boot:

  Unable to handle kernel paging request at virtual address ffff80018f9f0ffc
  pc : do_reset+0x3c/0x98
  Call trace:
   do_reset
   initramfs_test_extract
   kunit_try_run_case
  Initramfs unpacking failed: junk within compressed archive

do_reset() faults because 'victim' was overwritten by the boot-time
unpacker; the boot unpacker meanwhile logs the bogus "junk within
compressed archive" on the real initrd because the test wrecked its
state machine.

Add a suite .init that calls wait_for_initramfs() so the async unpack
is quiescent before the first case runs.

To: Alexander Viro <viro@zeniv.linux.org.uk>
To: Christian Brauner <brauner@kernel.org>
To: Jan Kara <jack@suse.cz>
To: David Disseldorp <ddiss@suse.de>
Cc: linux-fsdevel@vger.kernel.org

Fixes: 83c0b27266ec ("initramfs_test: kunit tests for initramfs unpacking")
Signed-off-by: Jia He <justin.he@arm.com>
---
 init/initramfs_test.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/init/initramfs_test.c b/init/initramfs_test.c
index 2ce38d9a8fd0..eb76f63f302e 100644
--- a/init/initramfs_test.c
+++ b/init/initramfs_test.c
@@ -3,7 +3,9 @@
 #include <linux/fcntl.h>
 #include <linux/file.h>
 #include <linux/fs.h>
+#include <linux/init.h>
 #include <linux/init_syscalls.h>
+#include <linux/initrd.h>
 #include <linux/stringify.h>
 #include <linux/timekeeping.h>
 #include "initramfs_internal.h"
@@ -510,8 +512,21 @@ static struct kunit_case __refdata initramfs_test_cases[] = {
 	{},
 };
 
-static struct kunit_suite initramfs_test_suite = {
+static int __init initramfs_test_init(struct kunit *test)
+{
+	/*
+	 * unpack_to_rootfs() uses module-static state (victim, byte_count,
+	 * state, ...). The boot-time async do_populate_rootfs() may still be
+	 * running, so wait for it to finish before we call unpack_to_rootfs()
+	 * from the test thread, otherwise the two writers race and crash.
+	 */
+	wait_for_initramfs();
+	return 0;
+}
+
+static struct kunit_suite __refdata initramfs_test_suite = {
 	.name = "initramfs",
+	.init = initramfs_test_init,
 	.test_cases = initramfs_test_cases,
 };
 kunit_test_init_section_suites(&initramfs_test_suite);
-- 
2.34.1

Re: [PATCH 1/7] init/initramfs_test: wait_for_initramfs() before running

[David Disseldorp]

On Thu, 14 May 2026 05:04:49 +0000, Jia He wrote:
...
> Add a suite .init that calls wait_for_initramfs() so the async unpack
> is quiescent before the first case runs.
> 
> To: Alexander Viro <viro@zeniv.linux.org.uk>
> To: Christian Brauner <brauner@kernel.org>
> To: Jan Kara <jack@suse.cz>
> To: David Disseldorp <ddiss@suse.de>
> Cc: linux-fsdevel@vger.kernel.org
> 
> Fixes: 83c0b27266ec ("initramfs_test: kunit tests for initramfs unpacking")
> Signed-off-by: Jia He <justin.he@arm.com>

Good catch, thanks.
Reviewed-by: David Disseldorp <ddiss@suse.de>

[PATCH 2/7] kfence: kunit: skip when no pool is available

[Jia He]

When KFENCE is compiled in but disabled at boot (KFENCE_SAMPLE_INTERVAL=0)
or __kfence_pool is not allocated, every kfence kunit case fails with
-EINVAL.

Use kunit_skip() so they are reported as skipped instead.

To: Alexander Potapenko <glider@google.com>
To: Marco Elver <elver@google.com>
To: Dmitry Vyukov <dvyukov@google.com>
To: Andrew Morton <akpm@linux-foundation.org>
Cc: kasan-dev@googlegroups.com
Cc: linux-mm@kvack.org

Signed-off-by: Jia He <justin.he@arm.com>
---
 mm/kfence/kfence_test.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/mm/kfence/kfence_test.c b/mm/kfence/kfence_test.c
index 5725a367246d..e376329dd621 100644
--- a/mm/kfence/kfence_test.c
+++ b/mm/kfence/kfence_test.c
@@ -822,8 +822,10 @@ static int test_init(struct kunit *test)
 	unsigned long flags;
 	int i;
 
-	if (!__kfence_pool)
-		return -EINVAL;
+	if (!__kfence_pool) {
+		kunit_skip(test, "kfence pool not allocated or kfence not enabled");
+		return 0;
+	}
 
 	spin_lock_irqsave(&observed.lock, flags);
 	for (i = 0; i < ARRAY_SIZE(observed.lines); i++)
-- 
2.34.1

Re: [PATCH 2/7] kfence: kunit: skip when no pool is available

[Marco Elver]

On Thu, 14 May 2026 at 07:07, Jia He <justin.he@arm.com> wrote:
>
> When KFENCE is compiled in but disabled at boot (KFENCE_SAMPLE_INTERVAL=0)
> or __kfence_pool is not allocated, every kfence kunit case fails with
> -EINVAL.
>
> Use kunit_skip() so they are reported as skipped instead.
>
> To: Alexander Potapenko <glider@google.com>
> To: Marco Elver <elver@google.com>
> To: Dmitry Vyukov <dvyukov@google.com>
> To: Andrew Morton <akpm@linux-foundation.org>
> Cc: kasan-dev@googlegroups.com
> Cc: linux-mm@kvack.org
>
> Signed-off-by: Jia He <justin.he@arm.com>

Acked-by: Marco Elver <elver@google.com>

Fair enough - typically this failure was a way to know something went
wrong in the test setup. But I also understand that it's not always
possible to just not load this test if kfence is not enabled, say with
some compliance test suites or such.

> ---
>  mm/kfence/kfence_test.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/mm/kfence/kfence_test.c b/mm/kfence/kfence_test.c
> index 5725a367246d..e376329dd621 100644
> --- a/mm/kfence/kfence_test.c
> +++ b/mm/kfence/kfence_test.c
> @@ -822,8 +822,10 @@ static int test_init(struct kunit *test)
>         unsigned long flags;
>         int i;
>
> -       if (!__kfence_pool)
> -               return -EINVAL;
> +       if (!__kfence_pool) {
> +               kunit_skip(test, "kfence pool not allocated or kfence not enabled");
> +               return 0;
> +       }
>
>         spin_lock_irqsave(&observed.lock, flags);
>         for (i = 0; i < ARRAY_SIZE(observed.lines); i++)
> --
> 2.34.1
>

[PATCH 3/7] lib/math/int_log: drop WARN_ON for value == 0

[Jia He]

intlog2(0) and intlog10(0) already return 0, and the math-int_log
kunit suite passes {0, 0} as a valid input. The leftover WARN_ON(1) on
that path produces a backtrace per test run. Just remove it.

Signed-off-by: Jia He <justin.he@arm.com>
---
 lib/math/int_log.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/lib/math/int_log.c b/lib/math/int_log.c
index 8f9da3a2ad39..8585207cbe7f 100644
--- a/lib/math/int_log.c
+++ b/lib/math/int_log.c
@@ -59,10 +59,8 @@ unsigned int intlog2(u32 value)
 	unsigned int significand;
 	unsigned int interpolation;
 
-	if (unlikely(value == 0)) {
-		WARN_ON(1);
+	if (unlikely(value == 0))
 		return 0;
-	}
 
 	/* first detect the msb (count begins at 0) */
 	msb = fls(value) - 1;
@@ -116,10 +114,8 @@ unsigned int intlog10(u32 value)
 	 */
 	u64 log;
 
-	if (unlikely(value == 0)) {
-		WARN_ON(1);
+	if (unlikely(value == 0))
 		return 0;
-	}
 
 	log = intlog2(value);
 
-- 
2.34.1

[PATCH 4/7] kunit: platform: catch duplicate (name, id) in kunit_platform_device_add()

[Jia He]

kunit_platform_device_add_twice_fails_test registers the same device
twice and expects failure. Without an early check the second
platform_device_add() reaches sysfs_create_dir_ns() and dumps a
backtrace via sysfs_warn_dup() on every run.

Walk the platform bus for a device with matching name and id and return
-EEXIST. PLATFORM_DEVID_AUTO assigns its id inside add() and can't
collide, so skip it.

To: Brendan Higgins <brendan.higgins@linux.dev>
To: David Gow <david@davidgow.net>
To: Rae Moar <raemoar63@gmail.com>
Cc: linux-kselftest@vger.kernel.org
Cc: kunit-dev@googlegroups.com

Signed-off-by: Jia He <justin.he@arm.com>
---
 lib/kunit/platform.c | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/lib/kunit/platform.c b/lib/kunit/platform.c
index 0b518de26065..515f7c859014 100644
--- a/lib/kunit/platform.c
+++ b/lib/kunit/platform.c
@@ -7,6 +7,7 @@
 #include <linux/device/bus.h>
 #include <linux/device/driver.h>
 #include <linux/platform_device.h>
+#include <linux/string.h>
 
 #include <kunit/platform_device.h>
 #include <kunit/resource.h>
@@ -80,6 +81,20 @@ kunit_platform_device_alloc_match(struct kunit *test,
 
 KUNIT_DEFINE_ACTION_WRAPPER(platform_device_unregister_wrapper,
 			    platform_device_unregister, struct platform_device *);
+
+struct kunit_pdev_dup_match {
+	const char *name;
+	int id;
+};
+
+static int kunit_pdev_dup_match_fn(struct device *dev, void *data)
+{
+	struct kunit_pdev_dup_match *m = data;
+	struct platform_device *p = to_platform_device(dev);
+
+	return p->id == m->id && p->name && !strcmp(p->name, m->name);
+}
+
 /**
  * kunit_platform_device_add() - Register a KUnit test managed platform device
  * @test: test context
@@ -95,6 +110,22 @@ int kunit_platform_device_add(struct kunit *test, struct platform_device *pdev)
 	struct kunit_resource *res;
 	int ret;
 
+	/*
+	 * Detect duplicate (name, id) registrations early, before
+	 * platform_device_add() reaches sysfs_create_dir_ns() and
+	 * unconditionally dumps a stack trace via sysfs_warn_dup(). This keeps
+	 * tests that intentionally exercise the duplicate-add failure path
+	 * (e.g. kunit_platform_device_add_twice_fails_test) quiet without
+	 * losing the negative return value they assert on.
+	 */
+	if (pdev->name && pdev->id != PLATFORM_DEVID_AUTO) {
+		struct kunit_pdev_dup_match m = { pdev->name, pdev->id };
+
+		if (bus_for_each_dev(&platform_bus_type, NULL, &m,
+				     kunit_pdev_dup_match_fn))
+			return -EEXIST;
+	}
+
 	ret = platform_device_add(pdev);
 	if (ret)
 		return ret;
-- 
2.34.1

[PATCH 5/7] misc: reject duplicate names in misc_register()

[Jia He]

The miscdev kunit suite registers two miscdevices with the same name
and expects -EEXIST. The second call currently goes all the way to
sysfs_create_dir_ns(), which prints "cannot create duplicate filename"
with a backtrace on every run.

Walk misc_list under misc_mtx, return -EEXIST on a name collision and
free the just-allocated minor before returning.

To: Arnd Bergmann <arnd@arndb.de>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: Jia He <justin.he@arm.com>
---
 drivers/char/misc.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/drivers/char/misc.c b/drivers/char/misc.c
index 726516fb0a3b..d6ffa21ac495 100644
--- a/drivers/char/misc.c
+++ b/drivers/char/misc.c
@@ -248,6 +248,28 @@ int misc_register(struct miscdevice *misc)
 		}
 	}
 
+	/*
+	 * Detect duplicate names up-front so the subsequent
+	 * device_create_with_groups() does not trip
+	 * sysfs_create_dir_ns()->sysfs_warn_dup(), which unconditionally
+	 * dumps a stack trace. Both the existing miscdev kunit suite
+	 * (miscdev_test_duplicate_name) and any caller racing on the same
+	 * name would otherwise pollute dmesg on every -EEXIST.
+	 */
+	{
+		struct miscdevice *c;
+
+		list_for_each_entry(c, &misc_list, list) {
+			if (strcmp(c->name, misc->name) == 0) {
+				misc_minor_free(misc->minor);
+				if (is_dynamic)
+					misc->minor = MISC_DYNAMIC_MINOR;
+				err = -EEXIST;
+				goto out;
+			}
+		}
+	}
+
 	dev = MKDEV(MISC_MAJOR, misc->minor);
 
 	misc->this_device =
-- 
2.34.1

Re: [PATCH 5/7] misc: reject duplicate names in misc_register()

[Greg Kroah-Hartman]

On Thu, May 14, 2026 at 05:04:53AM +0000, Jia He wrote:
> The miscdev kunit suite registers two miscdevices with the same name
> and expects -EEXIST. The second call currently goes all the way to
> sysfs_create_dir_ns(), which prints "cannot create duplicate filename"
> with a backtrace on every run.
> 
> Walk misc_list under misc_mtx, return -EEXIST on a name collision and
> free the just-allocated minor before returning.
> 
> To: Arnd Bergmann <arnd@arndb.de>
> To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

This should be Cc: right?

> 
> Signed-off-by: Jia He <justin.he@arm.com>
> ---
>  drivers/char/misc.c | 22 ++++++++++++++++++++++
>  1 file changed, 22 insertions(+)
> 
> diff --git a/drivers/char/misc.c b/drivers/char/misc.c
> index 726516fb0a3b..d6ffa21ac495 100644
> --- a/drivers/char/misc.c
> +++ b/drivers/char/misc.c
> @@ -248,6 +248,28 @@ int misc_register(struct miscdevice *misc)
>  		}
>  	}
>  
> +	/*
> +	 * Detect duplicate names up-front so the subsequent
> +	 * device_create_with_groups() does not trip
> +	 * sysfs_create_dir_ns()->sysfs_warn_dup(), which unconditionally
> +	 * dumps a stack trace. Both the existing miscdev kunit suite
> +	 * (miscdev_test_duplicate_name) and any caller racing on the same
> +	 * name would otherwise pollute dmesg on every -EEXIST.
> +	 */
> +	{
> +		struct miscdevice *c;
> +
> +		list_for_each_entry(c, &misc_list, list) {
> +			if (strcmp(c->name, misc->name) == 0) {
> +				misc_minor_free(misc->minor);
> +				if (is_dynamic)
> +					misc->minor = MISC_DYNAMIC_MINOR;
> +				err = -EEXIST;
> +				goto out;
> +			}
> +		}
> +	}

Don't do additional {} where not needed.

And as the current code works properly, we are relying on sysfs for the
rejection, why do this now here?  The stack dump is good, it shows the
offending caller, so they can fix it up better.  So why change this?

thanks,

greg k-h

RE: [PATCH 5/7] misc: reject duplicate names in misc_register()

[Justin He]

> -----Original Message-----
> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Sent: Thursday, May 14, 2026 3:00 PM
> To: Justin He <Justin.He@arm.com>
> Cc: linux-kernel@vger.kernel.org; linux-fsdevel@vger.kernel.org; linux-perf-
> users@vger.kernel.org; linux-kselftest@vger.kernel.org; kunit-
> dev@googlegroups.com; kasan-dev@googlegroups.com; linux-
> mm@kvack.org; Arnd Bergmann <arnd@arndb.de>; Alexander Viro
> <viro@zeniv.linux.org.uk>; Christian Brauner <brauner@kernel.org>; Jan Kara
> <jack@suse.cz>; Peter Zijlstra <peterz@infradead.org>; Ingo Molnar
> <mingo@redhat.com>; Arnaldo Carvalho de Melo <acme@kernel.org>;
> Namhyung Kim <namhyung@kernel.org>; Mark Rutland
> <Mark.Rutland@arm.com>; Alexander Shishkin
> <alexander.shishkin@linux.intel.com>; Jiri Olsa <jolsa@kernel.org>; Ian
> Rogers <irogers@google.com>; Adrian Hunter <adrian.hunter@intel.com>;
> James Clark <james.clark@linaro.org>; Brendan Higgins
> <brendan.higgins@linux.dev>; David Gow <david@davidgow.net>; Rae Moar
> <raemoar63@gmail.com>; Alexander Potapenko <glider@google.com>;
> Marco Elver <elver@google.com>; Dmitry Vyukov <dvyukov@google.com>;
> Andrew Morton <akpm@linux-foundation.org>; Paul E. McKenney
> <paulmck@kernel.org>; Petr Mladek <pmladek@suse.com>; Kees Cook
> <kees@kernel.org>; David Disseldorp <ddiss@suse.de>
> Subject: Re: [PATCH 5/7] misc: reject duplicate names in misc_register()
> 
> On Thu, May 14, 2026 at 05:04:53AM +0000, Jia He wrote:
> > The miscdev kunit suite registers two miscdevices with the same name
> > and expects -EEXIST. The second call currently goes all the way to
> > sysfs_create_dir_ns(), which prints "cannot create duplicate filename"
> > with a backtrace on every run.
> >
> > Walk misc_list under misc_mtx, return -EEXIST on a name collision and
> > free the just-allocated minor before returning.
> >
> > To: Arnd Bergmann <arnd@arndb.de>
> > To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> 
> This should be Cc: right?
> 
> >
> > Signed-off-by: Jia He <justin.he@arm.com>
> > ---
> >  drivers/char/misc.c | 22 ++++++++++++++++++++++
> >  1 file changed, 22 insertions(+)
> >
> > diff --git a/drivers/char/misc.c b/drivers/char/misc.c index
> > 726516fb0a3b..d6ffa21ac495 100644
> > --- a/drivers/char/misc.c
> > +++ b/drivers/char/misc.c
> > @@ -248,6 +248,28 @@ int misc_register(struct miscdevice *misc)
> >  		}
> >  	}
> >
> > +	/*
> > +	 * Detect duplicate names up-front so the subsequent
> > +	 * device_create_with_groups() does not trip
> > +	 * sysfs_create_dir_ns()->sysfs_warn_dup(), which unconditionally
> > +	 * dumps a stack trace. Both the existing miscdev kunit suite
> > +	 * (miscdev_test_duplicate_name) and any caller racing on the same
> > +	 * name would otherwise pollute dmesg on every -EEXIST.
> > +	 */
> > +	{
> > +		struct miscdevice *c;
> > +
> > +		list_for_each_entry(c, &misc_list, list) {
> > +			if (strcmp(c->name, misc->name) == 0) {
> > +				misc_minor_free(misc->minor);
> > +				if (is_dynamic)
> > +					misc->minor =
> MISC_DYNAMIC_MINOR;
> > +				err = -EEXIST;
> > +				goto out;
> > +			}
> > +		}
> > +	}
> 
> Don't do additional {} where not needed.
> 
> And as the current code works properly, we are relying on sysfs for the
> rejection, why do this now here?  The stack dump is good, it shows the
> offending caller, so they can fix it up better.  So why change this?
> 
Thanks for the feedback.
I’ll drop the two patches that silence the sysfs warning for duplicate filenames.

--- 
Cheers,
Justin He(Jia He)

 

[PATCH 6/7] hw_breakpoint_test: fix test_many_cpus failure on large systems

[Jia He]

On systems with many CPUs (e.g. 128 cores x 4 HW breakpoint slots =
512 = MAX_TEST_BREAKPOINTS), test_many_cpus() advances idx to
MAX_TEST_BREAKPOINTS after the last fill_bp_slots(). The subsequent
register_test_bp() call hits WARN_ON(idx >= MAX_TEST_BREAKPOINTS),
returns NULL, and the -ENOSPC expectation fails.

Bail out of the loop when idx reaches the limit. Earlier iterations
already validate the NOSPC path on other CPUs.

To: Peter Zijlstra <peterz@infradead.org>
To: Ingo Molnar <mingo@redhat.com>
To: Arnaldo Carvalho de Melo <acme@kernel.org>
To: Namhyung Kim <namhyung@kernel.org>
To: Mark Rutland <mark.rutland@arm.com>
To: Alexander Shishkin <alexander.shishkin@linux.intel.com>
To: Jiri Olsa <jolsa@kernel.org>
To: Ian Rogers <irogers@google.com>
To: Adrian Hunter <adrian.hunter@intel.com>
To: James Clark <james.clark@linaro.org>
Cc: linux-perf-users@vger.kernel.org

Signed-off-by: Jia He <justin.he@arm.com>
---
 kernel/events/hw_breakpoint_test.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/events/hw_breakpoint_test.c b/kernel/events/hw_breakpoint_test.c
index 2cfeeecf8de9..943d040d2224 100644
--- a/kernel/events/hw_breakpoint_test.c
+++ b/kernel/events/hw_breakpoint_test.c
@@ -137,6 +137,9 @@ static void test_many_cpus(struct kunit *test)
 	for_each_online_cpu(cpu) {
 		bool do_continue = fill_bp_slots(test, &idx, cpu, NULL, 0);
 
+		if (idx >= MAX_TEST_BREAKPOINTS)
+			break;
+
 		TEST_EXPECT_NOSPC(register_test_bp(cpu, NULL, idx));
 		if (!do_continue)
 			break;
-- 
2.34.1

Re: [PATCH 6/7] hw_breakpoint_test: fix test_many_cpus failure on large systems

[Marco Elver]

On Thu, 14 May 2026 at 07:08, Jia He <justin.he@arm.com> wrote:
>
> On systems with many CPUs (e.g. 128 cores x 4 HW breakpoint slots =
> 512 = MAX_TEST_BREAKPOINTS), test_many_cpus() advances idx to
> MAX_TEST_BREAKPOINTS after the last fill_bp_slots(). The subsequent
> register_test_bp() call hits WARN_ON(idx >= MAX_TEST_BREAKPOINTS),
> returns NULL, and the -ENOSPC expectation fails.
>
> Bail out of the loop when idx reaches the limit. Earlier iterations
> already validate the NOSPC path on other CPUs.
>
> To: Peter Zijlstra <peterz@infradead.org>
> To: Ingo Molnar <mingo@redhat.com>
> To: Arnaldo Carvalho de Melo <acme@kernel.org>
> To: Namhyung Kim <namhyung@kernel.org>
> To: Mark Rutland <mark.rutland@arm.com>
> To: Alexander Shishkin <alexander.shishkin@linux.intel.com>
> To: Jiri Olsa <jolsa@kernel.org>
> To: Ian Rogers <irogers@google.com>
> To: Adrian Hunter <adrian.hunter@intel.com>
> To: James Clark <james.clark@linaro.org>
> Cc: linux-perf-users@vger.kernel.org
>
> Signed-off-by: Jia He <justin.he@arm.com>

Reviewed-by: Marco Elver <elver@google.com>

> ---
>  kernel/events/hw_breakpoint_test.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/kernel/events/hw_breakpoint_test.c b/kernel/events/hw_breakpoint_test.c
> index 2cfeeecf8de9..943d040d2224 100644
> --- a/kernel/events/hw_breakpoint_test.c
> +++ b/kernel/events/hw_breakpoint_test.c
> @@ -137,6 +137,9 @@ static void test_many_cpus(struct kunit *test)
>         for_each_online_cpu(cpu) {
>                 bool do_continue = fill_bp_slots(test, &idx, cpu, NULL, 0);
>
> +               if (idx >= MAX_TEST_BREAKPOINTS)
> +                       break;
> +
>                 TEST_EXPECT_NOSPC(register_test_bp(cpu, NULL, idx));
>                 if (!do_continue)
>                         break;
> --
> 2.34.1
>

[PATCH 7/7] lib/tests: test_ratelimit: fix stress test thread lifecycle and leak

[Jia He]

The kthread return value was checked against the wrong variable (sktp
instead of sktp[i].tp), so WARN_ON_ONCE(!sktp->tp) fired at line 87.

Replace kthread_run() with kthread_create()+wake_up_process() so the
return value can be validated before assigning to sktp[i].tp. On
creation failure, jump to a common cleanup path that signals doneflag,
stops all already-started threads, and frees sktp. This avoids leaving
orphan kthreads and leaked memory when a mid-loop failure occurs.

Also reset doneflag before spawning threads so back-to-back test
invocations don't race on stale state.

To: "Paul E. McKenney" <paulmck@kernel.org>
To: Petr Mladek <pmladek@suse.com>
To: Kees Cook <kees@kernel.org>

Signed-off-by: Jia He <justin.he@arm.com>
---
 lib/tests/test_ratelimit.c | 34 ++++++++++++++++++++++++++--------
 1 file changed, 26 insertions(+), 8 deletions(-)

diff --git a/lib/tests/test_ratelimit.c b/lib/tests/test_ratelimit.c
index 33cea5f3d28b..64f26260c0d8 100644
--- a/lib/tests/test_ratelimit.c
+++ b/lib/tests/test_ratelimit.c
@@ -105,26 +105,44 @@ static void test_ratelimit_stress(struct kunit *test)
 	const int n_stress_kthread = cpumask_weight(cpu_online_mask);
 	struct stress_kthread skt = { 0 };
 	struct stress_kthread *sktp = kzalloc_objs(*sktp, n_stress_kthread);
+	int n_started = 0;
 
-	KUNIT_EXPECT_NOT_NULL_MSG(test, sktp, "Memory allocation failure");
+	KUNIT_ASSERT_NOT_NULL_MSG(test, sktp, "Memory allocation failure");
+	WRITE_ONCE(doneflag, 0);
 	for (i = 0; i < n_stress_kthread; i++) {
-		sktp[i].tp = kthread_run(test_ratelimit_stress_child, &sktp[i], "%s/%i",
-					 "test_ratelimit_stress_child", i);
-		KUNIT_EXPECT_NOT_NULL_MSG(test, sktp, "kthread creation failure");
+		struct task_struct *tp;
+
+		tp = kthread_create(test_ratelimit_stress_child, &sktp[i],
+				    "%s/%i", "test_ratelimit_stress_child", i);
+		if (IS_ERR(tp)) {
+			KUNIT_FAIL(test, "kthread_create failed: %ld", PTR_ERR(tp));
+			goto out_stop;
+		}
+
+		sktp[i].tp = tp;
+		wake_up_process(tp);
+		n_started++;
 		pr_alert("Spawned test_ratelimit_stress_child %d\n", i);
 	}
 	schedule_timeout_idle(stress_duration);
+
+out_stop:
 	WRITE_ONCE(doneflag, 1);
-	for (i = 0; i < n_stress_kthread; i++) {
+	for (i = 0; i < n_started; i++) {
 		kthread_stop(sktp[i].tp);
 		skt.nattempts += sktp[i].nattempts;
 		skt.nunlimited += sktp[i].nunlimited;
 		skt.nlimited += sktp[i].nlimited;
 		skt.nmissed += sktp[i].nmissed;
 	}
-	KUNIT_ASSERT_EQ_MSG(test, skt.nunlimited + skt.nlimited, skt.nattempts,
-			    "Outcomes not equal to attempts");
-	KUNIT_ASSERT_EQ_MSG(test, skt.nlimited, skt.nmissed, "Misses not equal to limits");
+	if (n_started == n_stress_kthread) {
+		KUNIT_ASSERT_EQ_MSG(test, skt.nunlimited + skt.nlimited, skt.nattempts,
+				    "Outcomes not equal to attempts");
+		KUNIT_ASSERT_EQ_MSG(test, skt.nlimited, skt.nmissed,
+				    "Misses not equal to limits");
+	}
+
+	kfree(sktp);
 }
 
 static struct kunit_case ratelimit_test_cases[] = {
-- 
2.34.1

Re: [PATCH 0/7] Silence spurious warnings and crashes from kunit test suites

[Greg Kroah-Hartman]

On Thu, May 14, 2026 at 05:04:48AM +0000, Jia He wrote:
> Running the full kunit suite on arm64 (128-core Neoverse N2) with 7.1-rc3+
> produces a handful of backtraces that are not real kernel bugs but
> rather test-infrastructure issues: races with boot-time code, missing
> bounds checks, resource leaks, and sysfs duplicate-name splats.
> 
> This series fixes them one by one so that a clean kunit run no longer
> leaves noise in dmesg:

This series was sent to too many different people at once.  Always break
your changes up into subsystem-specific series as no one can take all of
these through their tree, and our tools, as you know, have a hard time
of just picking one patch out of a series.

thanks,

greg k-h

RE: [PATCH 0/7] Silence spurious warnings and crashes from kunit test suites

[Justin He]

> -----Original Message-----
> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Sent: Thursday, May 14, 2026 3:02 PM
> To: Justin He <Justin.He@arm.com>
> Cc: linux-kernel@vger.kernel.org; linux-fsdevel@vger.kernel.org; linux-perf-
> users@vger.kernel.org; linux-kselftest@vger.kernel.org; kunit-
> dev@googlegroups.com; kasan-dev@googlegroups.com; linux-
> mm@kvack.org; Arnd Bergmann <arnd@arndb.de>; Alexander Viro
> <viro@zeniv.linux.org.uk>; Christian Brauner <brauner@kernel.org>; Jan Kara
> <jack@suse.cz>; Peter Zijlstra <peterz@infradead.org>; Ingo Molnar
> <mingo@redhat.com>; Arnaldo Carvalho de Melo <acme@kernel.org>;
> Namhyung Kim <namhyung@kernel.org>; Mark Rutland
> <Mark.Rutland@arm.com>; Alexander Shishkin
> <alexander.shishkin@linux.intel.com>; Jiri Olsa <jolsa@kernel.org>; Ian
> Rogers <irogers@google.com>; Adrian Hunter <adrian.hunter@intel.com>;
> James Clark <james.clark@linaro.org>; Brendan Higgins
> <brendan.higgins@linux.dev>; David Gow <david@davidgow.net>; Rae Moar
> <raemoar63@gmail.com>; Alexander Potapenko <glider@google.com>;
> Marco Elver <elver@google.com>; Dmitry Vyukov <dvyukov@google.com>;
> Andrew Morton <akpm@linux-foundation.org>; Paul E. McKenney
> <paulmck@kernel.org>; Petr Mladek <pmladek@suse.com>; Kees Cook
> <kees@kernel.org>; David Disseldorp <ddiss@suse.de>
> Subject: Re: [PATCH 0/7] Silence spurious warnings and crashes from kunit
> test suites
> 
> On Thu, May 14, 2026 at 05:04:48AM +0000, Jia He wrote:
> > Running the full kunit suite on arm64 (128-core Neoverse N2) with
> > 7.1-rc3+ produces a handful of backtraces that are not real kernel
> > bugs but rather test-infrastructure issues: races with boot-time code,
> > missing bounds checks, resource leaks, and sysfs duplicate-name splats.
> >
> > This series fixes them one by one so that a clean kunit run no longer
> > leaves noise in dmesg:
> 
> This series was sent to too many different people at once.  Always break your
> changes up into subsystem-specific series as no one can take all of these
> through their tree, and our tools, as you know, have a hard time of just
> picking one patch out of a series.
> 
Ok, thanks for the feedback. I understand the concern.
I’ll split the changes into subsystem‑specific series and resend them accordingly.

--- 
Cheers,
Justin He(Jia He)