From nobody Sat Jul 25 06:09:13 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3B05219AD90; Fri, 17 Jul 2026 00:30:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784248233; cv=none; b=XL1vYLtKfs4HZBsmcl7sDyd/Qxk6U5oz46Ev2l8roySGUK7iwMIHQOMHhV+KPWH3qmHO/kH/55KOVqJPPG45SFQnNSPZ2lsG3oyK9HzVu3bbnR4gK0e1m8iuUy7RouNRXa3iak242i/+E64S6Btx38HekOKAOgXdWSUsGfWnCdo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784248233; c=relaxed/simple; bh=ioC4eodbAR+1Uyfpuko2Zd0ZkrM7igoZy/SFuML6ORE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=eqPsaA3QmRQobzDEKlryppTD+xShcYsH4XATvHuttBNVSYfla1UzN3Jsr4O+28/+9aFLpe3ynqMELNRBzg6qh82G58YT3k6HpqW3FBNEkBMclxN6M8Fc7oZA5wzarJ6kxt3CzWpoQ3wWKJvOgxWZMroTFVeZQGbEJXcXDn/hmmA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=BkibWEkx; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="BkibWEkx" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 951B91F00A3D; Fri, 17 Jul 2026 00:30:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784248231; bh=jqlH4wneWbMAf8JjBiLX1bTl/sVQqX7skPWoj8yoesY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=BkibWEkxEb645+nXZzhJof8SmEPgjDXdHTbm45OKlK4kuD4YBOW8QQ43Va/dMG/p4 F9153fCWi20R5wN2cEBvkAbpnBpJyylfMSfZbxFeXrzcvWGkcuS5ZuH0v1QqdNv8ZS Q/xpdyMEjE5nR0pBeOu+Te3l0SfopwLaxm5YgDAtkvaHs40Y5dJep+bDHv0RPXs0m5 fILC0tOyXUFC5eT77uj/ncpUY4HmWBDVcI5dAbdgDNw8sPRn1ZRkHCWg/VuzzMrVEH AX+S+zY9m7RE8oXplZwANRRtHrhJyD15fDISQR35w5DkD+VXaSy8WOyVSZDITP0Y75 DFDGZQUUX4FKg== From: SJ Park To: Cc: SJ Park , stable@vger.kernel.org, Andrew Morton , Brendan Higgins , David Gow , damon@lists.linux.dev, kunit-dev@googlegroups.com, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org Subject: [PATCH 1/7] mm/damon/core: initialize damos->last_applied Date: Thu, 16 Jul 2026 17:30:15 -0700 Message-ID: <20260717003022.119437-2-sj@kernel.org> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260717003022.119437-1-sj@kernel.org> References: <20260717003022.119437-1-sj@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Multiple DAMON regions could exist across a folio. If they fulfill the condition to apply a DAMOS scheme, the scheme could be applied multiple times to the folio. To avoid this, each DAMOS scheme stores the folio that the scheme was applied to last time in the damos->last_applied field and skips repeatedly applying the same scheme to the same folio. The field is being used without initialization, though. Hence, the mechanism could wrongly skip applying a scheme to a folio at the very first time of DAMOS run. The user impact is trivial. DAMON might unexpectedly skip applying DAMOS action for one folio for the first time per scheme. In the DAMON's best-effort world, this is never a real problem. No critical consequences such as kernel panic or memory corruption happen. It is a clear bug, though, and the fix is straightforward. Fix the issue by initializing the field in DAMOS scheme creation function, damon_new_scheme(). The issue was discovered [1] by Sashiko. [1] https://lore.kernel.org/20260714055436.120034-1-sj@kernel.org Fixes: 94ba17adaba0 ("mm/damon: avoid applying DAMOS action to same entity = multiple times") Cc: # 6.15.x Signed-off-by: SJ Park --- mm/damon/core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/mm/damon/core.c b/mm/damon/core.c index f464b4f0976c3..60255f5cd715e 100644 --- a/mm/damon/core.c +++ b/mm/damon/core.c @@ -705,6 +705,7 @@ struct damos *damon_new_scheme(struct damos_access_patt= ern *pattern, INIT_LIST_HEAD(&scheme->ops_filters); scheme->stat =3D (struct damos_stat){}; scheme->max_nr_snapshots =3D 0; + scheme->last_applied =3D NULL; INIT_LIST_HEAD(&scheme->list); =20 scheme->quota =3D *(damos_quota_init(quota)); --=20 2.47.3 From nobody Sat Jul 25 06:09:13 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A8D671A6809; Fri, 17 Jul 2026 00:30:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784248233; cv=none; b=Ud5I333kSR5eILbz7Grrp/SO9fXN5a5Ge6NdM6tp3tI+lLYliQehcZD4H+Mf6+9u8vMHt/OohTXqWEd1riv/mwhPgCxAULvdOt7FFO901LXTflmZ1KHJn80YJZ8YRMvEh3JZUFPCWiGxQKC0/KXsMDU8/e4O9LzVq9/gOCnsUnw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784248233; c=relaxed/simple; bh=A6BGFjnrb0sGxm4ySrgUnFdjJrEj1Y+uBT36j939Xnw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ZgCUwpRSwKHKXKDfUKMgX65uFUJf2H6atU66rI6Gk34Zx8UkHk87Gx5F3ZqGf8dJrmAp1YB+/yRn+OiEVnmUjX3pxbGeigYvozumBv2wkYCDxQMwXGsq87sBtW3Bzy6Jedui7FLvnbjqI66apFfrY5jh/ppXSO33146MXGqqY4w= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=SHxLEGKU; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="SHxLEGKU" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1BF641F00A3A; Fri, 17 Jul 2026 00:30:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784248232; bh=KyQzh9cAgWHiv+f51XfecFAFsLqN9MeOR+zzeRidaFs=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=SHxLEGKUEqPS/uTbTfuN0+qoZkrJv6a4zhRpq3omfyZC+J08m/+oglJROCBSlTPzj GKfzXuVdY+UrmQ0QmzR+DcJ1sz88rBYUBXIRhoDmTzBz/lqVDQi70d5TENIWU5/qWA wNqIyFi4BR0LKY3XxamQaNoR/KSHKrc+4Ms8ahKc5vkqBByi9J1sebsrFO9yLwwQWE qp3OH09VIleBYy7kqp2GfgU+uw9f/j14TPaRWPY1yco9K/FETGTKjbhqrfkVg+V6Kk 1v/BWQhr3AkWothaxP5dv0O1hvWwDwFGT//y4AiT2iYwO42eWM0mVjDlIa+LdbxUWi 6Ks/fxHQlMIpg== From: SJ Park To: Cc: SJ Park , stable@vger.kernel.org, Andrew Morton , Brendan Higgins , David Gow , SeongJae Park , damon@lists.linux.dev, kunit-dev@googlegroups.com, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org Subject: [PATCH 2/7] mm/damon/core-kunit: check region count before testing in split_at() Date: Thu, 16 Jul 2026 17:30:16 -0700 Message-ID: <20260717003022.119437-3-sj@kernel.org> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260717003022.119437-1-sj@kernel.org> References: <20260717003022.119437-1-sj@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" damon_test_split_at() test next region that is assumed to be created by damon_split_region_at() invocation. But the split might fail. In this case, the succeeding test may dereference invalid pointers returned by damon_next_region(). The invalid pointer may not cause a really bad user impact, because of the implementation detail. It would only read wrong contents in the belonging damon_target struct. Depending on the future change of the offset from the link header to the accessing field, this could also be really dangerous, though. Still, the realistic user impact would be limited. It would affect only test run setups. Fix it by testing if the number of regions was also changed as expected and exit early for the failure. The issue was discovered [1] by Sashiko. [1] https://lore.kernel.org/20260714142352.100478-1-sj@kernel.org Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests") Cc: # 5.15.x Signed-off-by: SJ Park --- mm/damon/tests/core-kunit.h | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h index eba643762132f..322a295ac2cec 100644 --- a/mm/damon/tests/core-kunit.h +++ b/mm/damon/tests/core-kunit.h @@ -155,6 +155,10 @@ static void damon_test_split_at(struct kunit *test) r->age =3D 10; damon_add_region(r, t); damon_split_region_at(t, r, 25); + KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 2); + if (damon_nr_regions(t) !=3D 2) + goto out; + KUNIT_EXPECT_EQ(test, r->ar.start, 0ul); KUNIT_EXPECT_EQ(test, r->ar.end, 25ul); =20 @@ -166,6 +170,7 @@ static void damon_test_split_at(struct kunit *test) KUNIT_EXPECT_EQ(test, r->last_nr_accesses, r_new->last_nr_accesses); KUNIT_EXPECT_EQ(test, r->age, r_new->age); =20 +out: damon_free_target(t); } =20 --=20 2.47.3 From nobody Sat Jul 25 06:09:13 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4CB941F1304; Fri, 17 Jul 2026 00:30:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784248234; cv=none; b=hzX2SjkpW7Kwj6fPg5sr0u4S93rq8Ju3yt2sT1pM67tMX6on2fA5N5bhAnkTu20Cj8hS1gGNAdLOih8L2IxOYK/Y9yZi9Lp4NwhmQu9KtUWCQisHHgA4ncn2lsoDVMguc1U1cCnrv7nZdnQHJwH/65P3/QsFdhUst8LiG/5tF9o= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784248234; c=relaxed/simple; bh=m0vrFx60LsajtXXWvXeyGJ4ELnn46NTe35fJet7iEZI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=PFcc4fiO/lANxa8ckMQffmUnNJimZJW0Srl8CSppieXulKNizTOI/dNYYewGe8rXwheRieezWtEuzzTf2jLAFu2qBDtxNu8afyMoHW6oP6hwshERs0GYfofPK06maRmduQ8VCSag+E0pR1MBnf5gto75A7IcRkq7eKMq26IiwuU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=CqisgCPZ; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="CqisgCPZ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A50681F00A3E; Fri, 17 Jul 2026 00:30:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784248233; bh=BYUt77gOaLnD9RIh57O9y6iLCV8DgyWvyhX78FkqqnI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=CqisgCPZUl48Ou9z48ijZHhC5VH6czNR2JUuXEuTjLYfK+ABnTZ1WYUSJBBEaJViq 8rcL20cpZE6eakFxXsNYDoCnNmbsUQuBDPFL5BJBrKsm1n9bNaN+QMZc39NeuAQ6Q9 t86qtkDK9Az16D6N8+psM/fNs2WLzHfhND0FtkqFUfUTq7RdNMJlHpKguDa/Qiwrih Timl+MUwRCOrDdUSg1dIKaGW8mDwEGssjBW7epSJimjnAvHa0yuFAZDKkBgDfpAQ+P nRzjhDyTymsNH1CqxnykxkbQbZE9DGveByiWJjSIMkjP6TNkAAu0mBTeIJ6jMXO3DO w4dwIU8QJYudw== From: SJ Park To: Cc: SJ Park , stable@vger.kernel.org, Andrew Morton , Brendan Higgins , David Gow , SeongJae Park , damon@lists.linux.dev, kunit-dev@googlegroups.com, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org Subject: [PATCH 3/7] mm/damon/vaddr-kunit: check region count in three_regions test Date: Thu, 16 Jul 2026 17:30:17 -0700 Message-ID: <20260717003022.119437-4-sj@kernel.org> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260717003022.119437-1-sj@kernel.org> References: <20260717003022.119437-1-sj@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" damon_do_test_apply_three_regions() iterates regions after damon_set_regions() call assuming the function would succeed at setting the number of regions the same to the expected one. It might have failed. In this case, __nth_region_of() in the iteration could return NULL and NULL dereference can happen in the test. The consequent user impact (NULL dereference) is quite bad. The realistic user impact would be limited, though. It would affect only test run setups. Fix it by testing if the number of regions was also changed as expected and exit early for the failure. The issue was discovered [1] by Sashiko. [1] https://lore.kernel.org/20260713144757.39740-1-sj@kernel.org Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests") Cc: # 5.15.x Signed-off-by: SJ Park --- mm/damon/tests/vaddr-kunit.h | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/mm/damon/tests/vaddr-kunit.h b/mm/damon/tests/vaddr-kunit.h index 61f844336ffb5..6a95441d193ae 100644 --- a/mm/damon/tests/vaddr-kunit.h +++ b/mm/damon/tests/vaddr-kunit.h @@ -158,12 +158,17 @@ static void damon_do_test_apply_three_regions(struct = kunit *test, kunit_skip(test, "second damon_set_regions() fail"); } =20 + KUNIT_EXPECT_EQ(test, damon_nr_regions(t), nr_expected / 2); + if (damon_nr_regions(t) !=3D nr_expected / 2) + goto out; + for (i =3D 0; i < nr_expected / 2; i++) { r =3D __nth_region_of(t, i); KUNIT_EXPECT_EQ(test, r->ar.start, expected[i * 2]); KUNIT_EXPECT_EQ(test, r->ar.end, expected[i * 2 + 1]); } =20 +out: damon_destroy_target(t, NULL); } =20 --=20 2.47.3 From nobody Sat Jul 25 06:09:13 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C0EEC233929; Fri, 17 Jul 2026 00:30:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784248234; cv=none; b=ghHbPrMqTtOhK3dNUKR8fLTENpctS2OLtoKBy4TvwQwkzx11zKgUx4nql9LVYG+y3p3TW109w8PguIi0FaRPzvjfCgBZPLiCa0UPSe4KaZ8m0vIBRbV4PDwrUaty6WcYmhsW3nAoWKWeoNRniAU5YPEdjS4bvPDLYjbjCITLPjA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784248234; c=relaxed/simple; bh=TeVi2a5VA6swQGzoHEeH3UFNCp1Li381UGVD5rPx9wU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Yz4TCpTxKhu6A6BWk8ReyAtoQWY3dSrDGHgHo8upqmQdsKr2QQlANJjGDQWUw6CvHYooeCwGilsGMgiXaSqGrSswdOAs6TZ6P3cmBWIqLebSy7MWOIwQF5G7etsxMkDUldJsnfpZWF2YalazgJ3+cUFtMnbjkcwUOcI1YQgM2lI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=CfAbMLTf; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="CfAbMLTf" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4292E1F000E9; Fri, 17 Jul 2026 00:30:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784248233; bh=rj9Z5Y27iRqji8iRGMFfcJYv5ZbfjmRp4XJwmqUyuks=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=CfAbMLTf558lsnXavsBfIowovwZYqHiUt4jX3iHP9sYrYd8xvWyRsvrpSvw0MSTWY nTcbokmih6UEEtk7TKjAgq6PEtBt7VusLCyE6/gkskuqKzlKEPlo6tHYl6nQ1TAkVa j+Srwx13jxoE3PzjlTZiqIb2fplrrza5feZkxkcAMJ9HLGRwnHSzv/5XpJPGIf8vRA 6sP2WNThsPfP5+a28TQJ9obpiIl6Zkye1TLUF3f/2wVAmTBrMqaDmdGjTKt0AqbSkx 97tj/l2r23MalKc/ingRhKlRlXWkRW1pjllfd7rXyMGpOatQYwoI+Yo4upeXu0ROJX SrEmPADQFTI7g== From: SJ Park To: Cc: SJ Park , stable@vger.kernel.org, Andrew Morton , Brendan Higgins , David Gow , damon@lists.linux.dev, kunit-dev@googlegroups.com, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org Subject: [PATCH 4/7] mm/damon/core-kunit: handle region split failure in filter_out() Date: Thu, 16 Jul 2026 17:30:18 -0700 Message-ID: <20260717003022.119437-5-sj@kernel.org> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260717003022.119437-1-sj@kernel.org> References: <20260717003022.119437-1-sj@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" dasmon_test_filter_out() test checks if damos_filter_match() of an address filter splits the region as expected under a given condition. But, the test continued regardless of the split successes. As a result, the later part of the test could dereference invalid pointers that returned from damon_next_region(). Further, it could corrupt memory from damon_destroy_region(). The consequent user impact (memory corruption) is quite bad. The realistic user impact would be limited, though. It would affect only test run setups. Fix it by exiting early for the number of regions test failure. The issue was discovered [1] by Sashiko. [1] https://lore.kernel.org/20260714142352.100478-1-sj@kernel.org Fixes: 26713c890875 ("mm/damon/core-test: add a unit test for __damos_filte= r_out()") Cc: # 6.6.x Signed-off-by: SJ Park --- mm/damon/tests/core-kunit.h | 3 +++ 1 file changed, 3 insertions(+) diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h index 322a295ac2cec..bd3bbd421392f 100644 --- a/mm/damon/tests/core-kunit.h +++ b/mm/damon/tests/core-kunit.h @@ -1365,6 +1365,8 @@ static void damos_test_filter_out(struct kunit *test) KUNIT_EXPECT_EQ(test, r->ar.start, 1); KUNIT_EXPECT_EQ(test, r->ar.end, 2); KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 2); + if (damon_nr_regions(t) !=3D 2) + goto out; r2 =3D damon_next_region(r); KUNIT_EXPECT_EQ(test, r2->ar.start, 2); KUNIT_EXPECT_EQ(test, r2->ar.end, 4); @@ -1384,6 +1386,7 @@ static void damos_test_filter_out(struct kunit *test) KUNIT_EXPECT_EQ(test, r2->ar.end, 8); damon_destroy_region(r2, t); =20 +out: damon_free_target(t); damos_free_filter(f); } --=20 2.47.3 From nobody Sat Jul 25 06:09:13 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5E9F42459C5; Fri, 17 Jul 2026 00:30:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784248235; cv=none; b=MbafSXJKhWBUL3e7ovn7WPi7IuJaLOQrAmd3IF4vQmGcXj/ff57ZK4hyGjv3FnORXkCjNj3zuQtg9wLL6jom5lUUpeyrqSGbZ2uTM0ih//c9vpLyXDRF7MulsULk1ObdFLzoo1LUwR6shGHwXSarg3hBPk+xpxFWcGxXBnbMbDM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784248235; c=relaxed/simple; bh=b6qPxOEcGo0Cve8cMWI+4Y4GfqMfH1uVgkgWSHQqX4U=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=U4TpPCe4C+Tew9f3SrsWYc2ZxIy8Rw0jCVzXv2YS8fPe4vQqpvlybHBK6Jt/NQjFutMPW+eY6ySXECo6r021dslsi9W4WqgIo8gCo3OiySEGNnR55OyVz42sbgXiT6SZngpj8W9jcM9Wd6jj9pbc4sK14D4US1IFNJW/rjG3Tf8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=R0Vnqaj1; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="R0Vnqaj1" Received: by smtp.kernel.org (Postfix) with ESMTPSA id BFB1A1F00A3F; Fri, 17 Jul 2026 00:30:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784248234; bh=paS1pLTVHYJo6IMXrYXcRnVhCRmTb+pKMWKQvGTyqxI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=R0Vnqaj1PiEaQ24gvhavkmJo45EQZ7Skd7tkOu3mi/0BMO48S0WkZ72qqvrTydCQr paKVzrOFteVIBL6i1sWXUhMcDmVKJXO4ubKO8JuO5se4bQu7rivEa9KqvqhhOXTvYD Rpe0Nr1SZkB5vZRXSJIvFLIjJu0KShDTgq+TXIeABAuSbF08xaZzJ2HxsPyTdhMdaJ FY/wnx7r0ZT87Q6E1SbZwpk+0b5D0/wYeVVtfEJpH+NR7IEmaWbPJtt9InsiiSBBAV igSb9YueJgSsXacLtaUDIcrRIaDYBmMJYpVUUb5hTNk5uri8flVCpA01F+FhAS39uD 7rCw9ylk2QANg== From: SJ Park To: Cc: SJ Park , stable@vger.kernel.org, Andrew Morton , Brendan Higgins , David Gow , damon@lists.linux.dev, kunit-dev@googlegroups.com, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org Subject: [PATCH 5/7] mm/damon/core-kunit: skip wrong dest walk in commit_dests_for() Date: Thu, 16 Jul 2026 17:30:19 -0700 Message-ID: <20260717003022.119437-6-sj@kernel.org> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260717003022.119437-1-sj@kernel.org> References: <20260717003022.119437-1-sj@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" damos_test_commit_dests_for() traverse damos action destinations after damos_commit_dests(). It assumes damos_commit_dests() made expected numbers of destinations for source and destination structures. It might not. Because the traversal is made based on destination struct length, it could do out of bounds access for source value expectation. The consequent user impact (out-of-bound access ) is quite bad. The realistic user impact would be limited, though. It would affect only test run setups. Fix it by exiting early for the number of regions test failure. The issue was discovered [1] by Sashiko. [1] https://lore.kernel.org/20260713144757.39740-1-sj@kernel.org Fixes: eec573b8dd65 ("mm/damon/tests/core-kunit: add damos_commit_dests() t= est") Cc: # 6.19.x Signed-off-by: SJ Park --- mm/damon/tests/core-kunit.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h index bd3bbd421392f..ca6ac12a15b24 100644 --- a/mm/damon/tests/core-kunit.h +++ b/mm/damon/tests/core-kunit.h @@ -1008,6 +1008,8 @@ static void damos_test_commit_dests_for(struct kunit = *test, skip =3D false; =20 KUNIT_EXPECT_EQ(test, dst.nr_dests, src_nr_dests); + if (dst.nr_dests !=3D src_nr_dests) + goto out; for (i =3D 0; i < dst.nr_dests; i++) { KUNIT_EXPECT_EQ(test, dst.node_id_arr[i], src_node_id_arr[i]); KUNIT_EXPECT_EQ(test, dst.weight_arr[i], src_weight_arr[i]); --=20 2.47.3 From nobody Sat Jul 25 06:09:13 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B34AD24E4B5; Fri, 17 Jul 2026 00:30:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784248236; cv=none; b=k5mTaeTlb3efpgF7wAu1B4+ZgjPcHtm3JuI9p5HmQSZvAi6Y5IE3pPbzr4yazKFhu2oeLtWgj893BmImzkiwQ6BETn+S9oXXhewhWFu9cA6GUmOfvuZb3gIiJKKw7Gh52Or2X5tOewB5dvnuequ6BPnViZWo4xLIaTR9hEfY7Fo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784248236; c=relaxed/simple; bh=GbtijrXS/fJksQBpv1ckRL+HADLq3+tvv+Z07G1PhJ8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=D0ZGFIR1ZzGRLKsMh7gBVfAykK2cFjiAIA7e3+WDZeviM/0GVVLRU7tDhHZShx+IrAGghUHBnYN4NQ2nR+8bYbVPzOasGqWvjYr5e1N3jKftuFcbOwvOfLSaIsHYhev23uXbmkXT+/6XTgP3R0kTTdzudNKQUSEvmdgxBuZfZ6U= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=fb0lKWnj; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="fb0lKWnj" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 486031F00A3D; Fri, 17 Jul 2026 00:30:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784248234; bh=bm88riwVWukBM9Hpj1tl+kCGJPZuHznDRrppgwqi3X8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=fb0lKWnjC7Lhue4mwWOJ3RaPskTLAAMn9qqA+kBPqmElzRq20exd/6JHMh/NhsoS/ CGp0Mi9k6iFwW0p+TjGqvMaGUMl4Nkv33jeh8pZnlvQFAvPGZC8mlU3iMR3CluiwFv fr6Sz/AMrTcxsGfQa4mXnC3/kkwIfoj2m1j+B1yq4+Y9Xw3/1uO1txgfxwHQZRzXXq BbzzzmILhLFqz60w9/7H0IMjC800EajT13tq0ny+KqU5uOsJuIObjf3pZ8DtM9bbg5 ihYJl8mIYnssBcN+NL9A8ITLcAnsCReeYAfrR5YXQi1Axq6pdvA6JBe2rPoFFd4j6p vJYWkATu5BJ6w== From: SJ Park To: Cc: SJ Park , stable@vger.kernel.org, Andrew Morton , Brendan Higgins , David Gow , damon@lists.linux.dev, kunit-dev@googlegroups.com, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org Subject: [PATCH 6/7] mm/damon/core-kunit: skip wrong quota goal walk in commit_quota_goals() Date: Thu, 16 Jul 2026 17:30:20 -0700 Message-ID: <20260717003022.119437-7-sj@kernel.org> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260717003022.119437-1-sj@kernel.org> References: <20260717003022.119437-1-sj@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" damos_test_commit_quota_goals_for() traverses damos quota goals after damos_commit_quota_goals() call. It assumes damos_commit_quota_goals() made expected numbers of goals. It might not. Because the traversal is made based on destination struct length, it could do out of bounds access for source expectation value array. The consequent user impact (out-of-bound access ) is quite bad. The realistic user impact would be limited though. It would affect only test run setups. Fix it by testing if the number of goals was also changed as expected and exit early for the failure. The issue was discovered [1] by Sashiko. [1] https://lore.kernel.org/20260713144757.39740-1-sj@kernel.org Fixes: d9adfb8a28e7 ("mm/damon/tests/core-kunit: add damos_commit_quota_goa= ls() test") Cc: # 6.19.x Signed-off-by: SJ Park --- mm/damon/tests/core-kunit.h | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h index ca6ac12a15b24..c0fc903a6a259 100644 --- a/mm/damon/tests/core-kunit.h +++ b/mm/damon/tests/core-kunit.h @@ -839,6 +839,7 @@ static void damos_test_commit_quota_goals_for(struct ku= nit *test, struct damos_quota_goal *goal, *next; bool skip =3D true; int i; + int nr_dst =3D 0, nr_src =3D 0; =20 INIT_LIST_HEAD(&dst.goals); INIT_LIST_HEAD(&src.goals); @@ -861,6 +862,14 @@ static void damos_test_commit_quota_goals_for(struct k= unit *test, =20 damos_commit_quota_goals(&dst, &src); =20 + damos_for_each_quota_goal(goal, &dst) + nr_dst++; + damos_for_each_quota_goal(goal, &src) + nr_src++; + KUNIT_EXPECT_EQ(test, nr_dst, nr_src); + if (nr_dst !=3D nr_src) + goto out; + i =3D 0; damos_for_each_quota_goal(goal, (&dst)) { KUNIT_EXPECT_EQ(test, goal->metric, src_goals[i].metric); --=20 2.47.3 From nobody Sat Jul 25 06:09:13 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3AD721E98EF; Fri, 17 Jul 2026 00:30:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784248236; cv=none; b=R8SC1t6DMW8LyKQilkvS1NC0dwDFon1RcpVEb0xiWLddnzO23rG3xUCyUWzl+hdCuylcYWLhcji+7eWJWOVQQY+LV8PPbrHV7yX1I5lilfaS1tzYzpQnNdzINZjAhr6NEPPVpDCtdb7EfbszBCPq5QbW5qYcRtdrUtfVOZMRKrk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784248236; c=relaxed/simple; bh=429dxDWsLoZqs3hLsuraUj4utp4t2KIte1wMXhahrBM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=dcQsM2FVE5oHWP5QIz/pvVzL8IxJau/Y+r8V1yQ4FBhPQVu3LQrnZWfbNMTZ3uHyuf6wnE1K21mgfchf5hCs054jn48CNMTlmhzDiHKALA23AHVbpQODRfilO1Nb4kSis85WD47RYBtHCNPUvrd3QUg8jMXpr7HoMcWSYQvJX10= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=mqolhtq3; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="mqolhtq3" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C61691F00A3A; Fri, 17 Jul 2026 00:30:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784248235; bh=f7BiQZV1zrUqjFiVsCPj2Z4br9MeBNP7ID/eB73kzGI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=mqolhtq3pNMNCV6TzxvelK3yiflgKnSTGhs8DriQEmCP7BXbeP6k7IY1RXlfOhhIe F1kIvO8YwVovdkAl/R0KGff+TwEU8nRp1e/xwnHYkhbt3lCZQPIOa6ZRHXuJ8beLD5 HExug7NiAVnfZ/Y65FhtLbbe4iwBHsdUDdKPvDHZ24vZ/X4WePwAzs+He7jTrfRHsc 5lKwSDxin7ncC41nAoxcJ3ZcsVKd8gd20s/Ratm+rLD4cupNU/NeywlQU0Hp1i6qH1 KhGlKZ8gD1Li5XDZGNwngrpG/lgXJC5lVop4aUWG7u3DV+olPmEZ2y5S1Fb5jkPo06 Kx6V/SfZ7wdug== From: SJ Park To: Cc: SJ Park , stable@vger.kernel.org, Andrew Morton , Brendan Higgins , David Gow , damon@lists.linux.dev, kunit-dev@googlegroups.com, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org Subject: [PATCH 7/7] mm/damon/core-kunit: skip wrong region walk in commit_target_regions() Date: Thu, 16 Jul 2026 17:30:21 -0700 Message-ID: <20260717003022.119437-8-sj@kernel.org> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260717003022.119437-1-sj@kernel.org> References: <20260717003022.119437-1-sj@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" damon_test_commit_target_regions_for() traverses expected values array after damon_commit_target_regions() call. It assumes damon_commit_target_regions() made expected number of regions. It might not. Because the traversal is made based on the region count, it could do out of bounds access to the expectation value array. The consequent user impact (out-of-bound access) is quite bad. The realistic user impact would be limited, though. It would affect only test run setups. Fix it by testing if the number of regions was also changed as expected and exit early for the failure. The issue was discovered [1] by Sashiko. [1] https://lore.kernel.org/20260713144757.39740-1-sj@kernel.org Fixes: 603f67eb91e0 ("mm/damon/tests/core-kunit: add damon_commit_target_re= gions() test") Cc: # 6.19.x Signed-off-by: SJ Park --- mm/damon/tests/core-kunit.h | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h index c0fc903a6a259..805d15a64500d 100644 --- a/mm/damon/tests/core-kunit.h +++ b/mm/damon/tests/core-kunit.h @@ -1277,14 +1277,19 @@ static void damon_test_commit_target_regions_for(st= ruct kunit *test, kunit_skip(test, "src target setup fail"); } damon_commit_target_regions(dst_target, src_target, 1); + + KUNIT_EXPECT_EQ(test, damon_nr_regions(dst_target), nr_expect_regions); + if (damon_nr_regions(dst_target) !=3D nr_expect_regions) + goto out; + i =3D 0; damon_for_each_region(r, dst_target) { KUNIT_EXPECT_EQ(test, r->ar.start, expect_start_end[i][0]); KUNIT_EXPECT_EQ(test, r->ar.end, expect_start_end[i][1]); i++; } - KUNIT_EXPECT_EQ(test, damon_nr_regions(dst_target), nr_expect_regions); - KUNIT_EXPECT_EQ(test, i, nr_expect_regions); + +out: damon_free_target(dst_target); damon_free_target(src_target); } --=20 2.47.3