From nobody Sat Jul 25 04:53:33 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7A47442A15A; Fri, 17 Jul 2026 14:34:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784298894; cv=none; b=QfG1isb20AnDjgzxNmIh3ACFYgKJeL9Pgc1FCvLjFY6b2lxp0WJgB1KiCZujEgmlklSCKG/NLae+Hsho8CZqK0nXjyqwQGzg82mOLueaRPGAaycpfZ4WXjhiFyoaMAqiv9v4VLJngT8eEPrsAwgP0u3YdHKBuex59jG/FDtgM8o= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784298894; c=relaxed/simple; bh=ioC4eodbAR+1Uyfpuko2Zd0ZkrM7igoZy/SFuML6ORE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=nsndIAC2OkgLSsj9yhs+WYT8BQcCRuGvBEorLBqtf0ocl3AL4Sol7bHZw8HCfLjb2pO+tjqBfquyUWiMtHDpM4NR0PJFDEYogzSbQxdFj/2VjNHaYsB9iBbWBVi5Ihbj8EwsEAYkEHtc+Uam3EE/WTZpj6zXBJRs68bivjc20VA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=E1VkfEE7; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="E1VkfEE7" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D50911F00A3D; Fri, 17 Jul 2026 14:34:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784298893; bh=jqlH4wneWbMAf8JjBiLX1bTl/sVQqX7skPWoj8yoesY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=E1VkfEE73Ld52yTp8XyAQnrJXqTiZfuPBrpHJg+wQgO+3sNQ0Iyu8PFiSyJKuDbfW 3LWPnW+dMyu7SVgLfgHiFoaZGVFY8xNd8VJu2HvUcIds2AT64Af4X2wpvGjjAIlYWr CLrl4T0i7m2CYniO15KQb6ZXzke4uxN7QXT/oY2PnJYdnfys+nwsgv85juPh4Gh1Dl ZGuVYrxhMsoNjjfaeFcQpFodyLIDvCoIsJDoyIgBeDLnLsDS68WGxSyzPhsTDCixx5 BFb0yKZ04XxR4H3Ii52aoGoEW7pZF983iz5p3Rmu7pdCgZ9Fi8s6OdJ93u6AalQbzP r6ZQ95HO5A2CA== From: SJ Park To: Cc: SJ Park , stable@vger.kernel.org, Andrew Morton , Brendan Higgins , David Gow , damon@lists.linux.dev, kunit-dev@googlegroups.com, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org Subject: [RFC PATCH v1.1 1/7] mm/damon/core: initialize damos->last_applied Date: Fri, 17 Jul 2026 07:34:38 -0700 Message-ID: <20260717143445.91207-2-sj@kernel.org> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260717143445.91207-1-sj@kernel.org> References: <20260717143445.91207-1-sj@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Multiple DAMON regions could exist across a folio. If they fulfill the condition to apply a DAMOS scheme, the scheme could be applied multiple times to the folio. To avoid this, each DAMOS scheme stores the folio that the scheme was applied to last time in the damos->last_applied field and skips repeatedly applying the same scheme to the same folio. The field is being used without initialization, though. Hence, the mechanism could wrongly skip applying a scheme to a folio at the very first time of DAMOS run. The user impact is trivial. DAMON might unexpectedly skip applying DAMOS action for one folio for the first time per scheme. In the DAMON's best-effort world, this is never a real problem. No critical consequences such as kernel panic or memory corruption happen. It is a clear bug, though, and the fix is straightforward. Fix the issue by initializing the field in DAMOS scheme creation function, damon_new_scheme(). The issue was discovered [1] by Sashiko. [1] https://lore.kernel.org/20260714055436.120034-1-sj@kernel.org Fixes: 94ba17adaba0 ("mm/damon: avoid applying DAMOS action to same entity = multiple times") Cc: # 6.15.x Signed-off-by: SJ Park --- mm/damon/core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/mm/damon/core.c b/mm/damon/core.c index f464b4f0976c3..60255f5cd715e 100644 --- a/mm/damon/core.c +++ b/mm/damon/core.c @@ -705,6 +705,7 @@ struct damos *damon_new_scheme(struct damos_access_patt= ern *pattern, INIT_LIST_HEAD(&scheme->ops_filters); scheme->stat =3D (struct damos_stat){}; scheme->max_nr_snapshots =3D 0; + scheme->last_applied =3D NULL; INIT_LIST_HEAD(&scheme->list); =20 scheme->quota =3D *(damos_quota_init(quota)); --=20 2.47.3 From nobody Sat Jul 25 04:53:33 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C1CB542A15F; Fri, 17 Jul 2026 14:34:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784298894; cv=none; b=LGmSt8awKWgKS4mZ9d5NOx1jIiAIyL7EO8cw+XAJyvoCUQGcYd6IKrSB9CfYNCP9ocKRXVls8glrItrmJJbLee87hD3+vlzqWnU99KjByBcEVmKkbsLPSV1tiDQfw9Mcf7UdZ4OsY0rdtHhYpKXt3A/uWnpIf52CyJkUhJ7jFa0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784298894; c=relaxed/simple; bh=A6BGFjnrb0sGxm4ySrgUnFdjJrEj1Y+uBT36j939Xnw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=V6Cv38lTjDWipxVco9cdQ5JHgBjcWNMC0vpxWhZPq1a2VLNMMhbgzZQV37pG0UTSaLS7BDVbcCURjDcpBmi3cwe90XO7SSDBEDbWGhJj38ZlSTaFTEgQyj8in4EjI1Ea0NGXQVamYsIV4Bntq3lWENeBjBj9eEsm2rQaOElOnzQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=bmloB99Y; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="bmloB99Y" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 53DEE1F00A3E; Fri, 17 Jul 2026 14:34:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784298893; bh=KyQzh9cAgWHiv+f51XfecFAFsLqN9MeOR+zzeRidaFs=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=bmloB99Ybx1WKgtIc+yxyRNZ4NVfaVa99uMGlmbik1P6sKwLzzUKxIgu2TG7hBFGt b7LMPjVozz0aZO5ICLqo1dC4+SHxox5Psc1/35wBHfgOelF9IiBkCrNr4DLLXat385 JbLTB6ejQXMC1x0uNT/Vta7tNeePtD7wpZ4433zw6NochFM0OsU1ZrkTnLthIGXnY0 afENsGXcK2SmtGyIAhqITzppKGuXMhYWRV3mHtdjKhwGOFnrMpfJjl/ge439/BwRXg vnLNrWh1dCNWKiy765pLRjX9qCXndU8tRfbhDUyx51IOHtATOwyMEJdW2Dqrz2fYMd PyRkMzt54ATXA== From: SJ Park To: Cc: SJ Park , stable@vger.kernel.org, Andrew Morton , Brendan Higgins , David Gow , SeongJae Park , damon@lists.linux.dev, kunit-dev@googlegroups.com, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org Subject: [RFC PATCH v1.1 2/7] mm/damon/core-kunit: check region count before testing in split_at() Date: Fri, 17 Jul 2026 07:34:39 -0700 Message-ID: <20260717143445.91207-3-sj@kernel.org> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260717143445.91207-1-sj@kernel.org> References: <20260717143445.91207-1-sj@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" damon_test_split_at() test next region that is assumed to be created by damon_split_region_at() invocation. But the split might fail. In this case, the succeeding test may dereference invalid pointers returned by damon_next_region(). The invalid pointer may not cause a really bad user impact, because of the implementation detail. It would only read wrong contents in the belonging damon_target struct. Depending on the future change of the offset from the link header to the accessing field, this could also be really dangerous, though. Still, the realistic user impact would be limited. It would affect only test run setups. Fix it by testing if the number of regions was also changed as expected and exit early for the failure. The issue was discovered [1] by Sashiko. [1] https://lore.kernel.org/20260714142352.100478-1-sj@kernel.org Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests") Cc: # 5.15.x Signed-off-by: SJ Park --- mm/damon/tests/core-kunit.h | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h index eba643762132f..322a295ac2cec 100644 --- a/mm/damon/tests/core-kunit.h +++ b/mm/damon/tests/core-kunit.h @@ -155,6 +155,10 @@ static void damon_test_split_at(struct kunit *test) r->age =3D 10; damon_add_region(r, t); damon_split_region_at(t, r, 25); + KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 2); + if (damon_nr_regions(t) !=3D 2) + goto out; + KUNIT_EXPECT_EQ(test, r->ar.start, 0ul); KUNIT_EXPECT_EQ(test, r->ar.end, 25ul); =20 @@ -166,6 +170,7 @@ static void damon_test_split_at(struct kunit *test) KUNIT_EXPECT_EQ(test, r->last_nr_accesses, r_new->last_nr_accesses); KUNIT_EXPECT_EQ(test, r->age, r_new->age); =20 +out: damon_free_target(t); } =20 --=20 2.47.3 From nobody Sat Jul 25 04:53:33 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4C4E942A799; Fri, 17 Jul 2026 14:34:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784298895; cv=none; b=ad5LgeizS1RhtDGTQR8Wr5tjfdVFszrewhKpE+1sH2djCwZrzuw0gA1mB20siG/UmPdYdgXBTiXFjEMb1dYhIO9jAuz0QE3vwUopGNyp9VfFlTd01hWQ0WGAJghvapcRdZ8ico6MsjoSuZjCmakok43AYCahDaCq0yfD5qG8mdI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784298895; c=relaxed/simple; bh=m0vrFx60LsajtXXWvXeyGJ4ELnn46NTe35fJet7iEZI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=L3BvEL1468vIMwGYfbeCrlF6drsx1wbmYK4TipJEJHgV7E+WHP/fKtBB+R6KzhuJhd/WkdOQn3HS3IhHQJeEzec1tJJvJUnmgwjvUKRaB5NSNCuvhcZ4UgVyTuthr/QUNOG73bXyU81AxmFU4y3EWhLoLQ0OOkA7fRRfZCacgZ4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=jAmFrdPY; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="jAmFrdPY" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CE41B1F00AC4; Fri, 17 Jul 2026 14:34:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784298894; bh=BYUt77gOaLnD9RIh57O9y6iLCV8DgyWvyhX78FkqqnI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=jAmFrdPY24XYQ5acDhq7jYcbFZYkwynaIqmqMPtnVezWvFejovFVxwCFlwpRvPx14 06wZVFqeO37V8QGxAOu3+2PE/V95PPU/bId3A4HL5wH0Xt5ZjbDYX9eciKZd2vLRlm DsY2T580QzVOcjGrA13jhqCWtzdY4rj8IMGgkq5rK/87t2XSI5nVElYCsNqFnJ8szQ nCN9staruM05HlIJyLIwjwhBZx3aV+g2NBE8L7HthHO4oTaNX3fbwJ2VrVU5lvTlyE TgpxUiV3n4va0xkg+KOIwu3KzUJ7Z5C2c3YrBK5o1d2SqyPB3ikoFuOzew0AxisEKl ytjn4DAXvz8yw== From: SJ Park To: Cc: SJ Park , stable@vger.kernel.org, Andrew Morton , Brendan Higgins , David Gow , SeongJae Park , damon@lists.linux.dev, kunit-dev@googlegroups.com, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org Subject: [RFC PATCH v1.1 3/7] mm/damon/vaddr-kunit: check region count in three_regions test Date: Fri, 17 Jul 2026 07:34:40 -0700 Message-ID: <20260717143445.91207-4-sj@kernel.org> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260717143445.91207-1-sj@kernel.org> References: <20260717143445.91207-1-sj@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" damon_do_test_apply_three_regions() iterates regions after damon_set_regions() call assuming the function would succeed at setting the number of regions the same to the expected one. It might have failed. In this case, __nth_region_of() in the iteration could return NULL and NULL dereference can happen in the test. The consequent user impact (NULL dereference) is quite bad. The realistic user impact would be limited, though. It would affect only test run setups. Fix it by testing if the number of regions was also changed as expected and exit early for the failure. The issue was discovered [1] by Sashiko. [1] https://lore.kernel.org/20260713144757.39740-1-sj@kernel.org Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests") Cc: # 5.15.x Signed-off-by: SJ Park --- mm/damon/tests/vaddr-kunit.h | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/mm/damon/tests/vaddr-kunit.h b/mm/damon/tests/vaddr-kunit.h index 61f844336ffb5..6a95441d193ae 100644 --- a/mm/damon/tests/vaddr-kunit.h +++ b/mm/damon/tests/vaddr-kunit.h @@ -158,12 +158,17 @@ static void damon_do_test_apply_three_regions(struct = kunit *test, kunit_skip(test, "second damon_set_regions() fail"); } =20 + KUNIT_EXPECT_EQ(test, damon_nr_regions(t), nr_expected / 2); + if (damon_nr_regions(t) !=3D nr_expected / 2) + goto out; + for (i =3D 0; i < nr_expected / 2; i++) { r =3D __nth_region_of(t, i); KUNIT_EXPECT_EQ(test, r->ar.start, expected[i * 2]); KUNIT_EXPECT_EQ(test, r->ar.end, expected[i * 2 + 1]); } =20 +out: damon_destroy_target(t, NULL); } =20 --=20 2.47.3 From nobody Sat Jul 25 04:53:33 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D5BD342A7B5; Fri, 17 Jul 2026 14:34:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784298896; cv=none; b=XyAUA1HVKkQvzM15HTSlP2uyvqm4QV3UwcOmJiFwLvlhrQ/OCbo0OCsm/e9YKm1XMzWxY/nehIQ7epdnDMMyGepbLvodZtaGCTt7evoRnze2VbYPBiCkFjQxDCbLn6NwI5ab3RmF0doDu1lhpfiy+ZP6feE+BqngiEdFI6L4X+I= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784298896; c=relaxed/simple; bh=ILjTYHuIfdw7uvX4Y1fhjhJEasaEw8iiRHuJ4SiGEnQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=VXj9Hf6tGypv7Jj8Ghugkv20oAKQwheRZMFH57lIX8cGCwF7BjEcBMFHm5X7+uXu8V9m5SlagvBBypfdE6n0ER5qj/+B9uddS+SHBjnHJ32Z0TQNaddWGEbNLb3mo9YmN6wevQRWPPkytiuFPL4akLkY7NVCIGWfgvOmIeJ4qvk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=eS/razpG; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="eS/razpG" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 516AD1F00ADB; Fri, 17 Jul 2026 14:34:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784298894; bh=cUz2au4OyIrV9kPXUAznd25PGFTMj7HneR6m36jCxn4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=eS/razpG6Ph1ZltnxIDbC+HYJ37YmUoFCG7DAoVLnZHEFU2EFWpXvcnJ0fFzkFZ2B phd3vUyNk8S9JwshuluPwfJ2KNI/djoj4j3jT9PxC7c2W6HdhkNLE3TwoZ4vMFMtSp JEOURclbt3SSvWi+Wd5cBGutyYtfIhUlox97uIHESs3HEb4MR8Zk5NOJjJ5vOZC96b UVVtn6QAr2z2K2HCy/2pZdAx+W9sqRcKHBm3H3a5tURQPypgj7WrnWkZTLoRODTSQf LxJtGzShZ7bMcrXjmvtxIVnoriJAVFN6FcQ46ctVn6/8XZ+U6ZzHDsP0QM2KSF4w3U OlBYagyBFjkxA== From: SJ Park To: Cc: SJ Park , stable@vger.kernel.org, Andrew Morton , Brendan Higgins , David Gow , damon@lists.linux.dev, kunit-dev@googlegroups.com, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org Subject: [RFC PATCH v1.1 4/7] mm/damon/core-kunit: handle region split failure in filter_out() Date: Fri, 17 Jul 2026 07:34:41 -0700 Message-ID: <20260717143445.91207-5-sj@kernel.org> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260717143445.91207-1-sj@kernel.org> References: <20260717143445.91207-1-sj@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" dasmon_test_filter_out() test checks if damos_filter_match() of an address filter splits the region as expected under a given condition. But, the test continued regardless of the split successes. As a result, the later part of the test could dereference invalid pointers that returned from damon_next_region(). Further, it could corrupt memory from damon_destroy_region(). The consequent user impact (memory corruption) is quite bad. The realistic user impact would be limited, though. It would affect only test run setups. Fix it by exiting early for the number of regions test failure. The issue was discovered [1] by Sashiko. [1] https://lore.kernel.org/20260714142352.100478-1-sj@kernel.org Fixes: 26713c890875 ("mm/damon/core-test: add a unit test for __damos_filte= r_out()") Cc: # 6.6.x Signed-off-by: SJ Park --- mm/damon/tests/core-kunit.h | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h index 322a295ac2cec..eddf3a0484583 100644 --- a/mm/damon/tests/core-kunit.h +++ b/mm/damon/tests/core-kunit.h @@ -1365,6 +1365,8 @@ static void damos_test_filter_out(struct kunit *test) KUNIT_EXPECT_EQ(test, r->ar.start, 1); KUNIT_EXPECT_EQ(test, r->ar.end, 2); KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 2); + if (damon_nr_regions(t) !=3D 2) + goto out; r2 =3D damon_next_region(r); KUNIT_EXPECT_EQ(test, r2->ar.start, 2); KUNIT_EXPECT_EQ(test, r2->ar.end, 4); @@ -1379,11 +1381,14 @@ static void damos_test_filter_out(struct kunit *tes= t) KUNIT_EXPECT_EQ(test, r->ar.start, 2); KUNIT_EXPECT_EQ(test, r->ar.end, 6); KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 2); + if (damon_nr_regions(t) !=3D 2) + goto out; r2 =3D damon_next_region(r); KUNIT_EXPECT_EQ(test, r2->ar.start, 6); KUNIT_EXPECT_EQ(test, r2->ar.end, 8); damon_destroy_region(r2, t); =20 +out: damon_free_target(t); damos_free_filter(f); } --=20 2.47.3 From nobody Sat Jul 25 04:53:33 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5E79E42B320; Fri, 17 Jul 2026 14:34:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784298896; cv=none; b=Da3PLfx/+3iUyyHNnjbP4kWUjT3N8kAFtRyE6ydDNONzK6GQnyKgxFdLkKQVXZgJMP5/dzfP5H9WNOx78YJdotcolvZGqXJDop7pYwk4Y8tPowTBSZyx3mxyWFTbACzfhtT1tSDKGznt+YGY9TsCGC06E3yXg2rv3efZi+iyUnA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784298896; c=relaxed/simple; bh=6cVktXVE8rSuUMJmgI4PsGketuF/LIliSMcwhDwymn4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=nEquGatndc3fvWDnOTFD36NUq9+c4IJI8LYy5arcggY8PVkeRbYhRAczwv0A5wavuKINQi3SJQaH8Nv2LJJvnVY6NvdFtNUnuCMOdlh3FWLSdeH93BDxqD2FGz01Z1P6bVrBd6PA2e6mVdfEHOkaiAMwGVSJB3fHwO02fpSi4rw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Npu9wM/T; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Npu9wM/T" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C27521F00A3D; Fri, 17 Jul 2026 14:34:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784298895; bh=VuPFx8TTNBzLXDK2qKBdCiBzn3J3hO3HBSaJVXSFOsw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Npu9wM/TLqqMdaAfSdeHwemKOKxjfT9xquH/SBQ26zMAMOE0gMCtf5t0szwG8Esb6 poykFcwsr++2y3b61XYNM4ZtqCTntwWmry6eL45jnAM9cacxRqDddpe0DtP1L6h2kb Ox90FQzu37+vqQYUTEkt3oD2W3I5KlGsPqsrtPnrmuSuxEkXB81yTLuCTKo4joNX5G UrsHYdslhn9ry++WIowcwhKq0o1DjvQfjyW9i3nB08avw4UmYX4a72eqUcS8NJuKE+ Wnek6HrXSIIdsWTYk+j1sAgQSrI8KKEgmzsM3TwgdXi6VSoS8Si4LFTC8tf1v9DHlj ni1I80XOT1qTQ== From: SJ Park To: Cc: SJ Park , stable@vger.kernel.org, Andrew Morton , Brendan Higgins , David Gow , damon@lists.linux.dev, kunit-dev@googlegroups.com, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org Subject: [RFC PATCH v1.1 5/7] mm/damon/core-kunit: skip wrong dest walk in commit_dests_for() Date: Fri, 17 Jul 2026 07:34:42 -0700 Message-ID: <20260717143445.91207-6-sj@kernel.org> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260717143445.91207-1-sj@kernel.org> References: <20260717143445.91207-1-sj@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" damos_test_commit_dests_for() traverse damos action destinations after damos_commit_dests(). It assumes damos_commit_dests() made expected numbers of destinations for source and destination structures. It might not. Because the traversal is made based on destination struct length, it could do out of bounds access for source value expectation. The consequent user impact (out-of-bound access ) is quite bad. The realistic user impact would be limited, though. It would affect only test run setups. Fix it by exiting early for the number of regions test failure. The issue was discovered [1] by Sashiko. [1] https://lore.kernel.org/20260713144757.39740-1-sj@kernel.org Fixes: eec573b8dd65 ("mm/damon/tests/core-kunit: add damos_commit_dests() t= est") Cc: # 6.19.x Signed-off-by: SJ Park --- mm/damon/tests/core-kunit.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h index eddf3a0484583..9b8c20a50ad53 100644 --- a/mm/damon/tests/core-kunit.h +++ b/mm/damon/tests/core-kunit.h @@ -1008,6 +1008,8 @@ static void damos_test_commit_dests_for(struct kunit = *test, skip =3D false; =20 KUNIT_EXPECT_EQ(test, dst.nr_dests, src_nr_dests); + if (dst.nr_dests !=3D src_nr_dests) + goto out; for (i =3D 0; i < dst.nr_dests; i++) { KUNIT_EXPECT_EQ(test, dst.node_id_arr[i], src_node_id_arr[i]); KUNIT_EXPECT_EQ(test, dst.weight_arr[i], src_weight_arr[i]); --=20 2.47.3 From nobody Sat Jul 25 04:53:33 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9F75642B337; Fri, 17 Jul 2026 14:34:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784298897; cv=none; b=e5wUKKVdU74RtqRP7mJ9U1tfUqwsFIaxVfuRSWNAUGHqPcLqOAe9U44nZ+He8r6JVsTH/BAW8wuvurorUE/Rct+DDvya/XDXYUq8dkoPDGwhCjYerihDzMu6cInoElXCPy70CSkMkb+7rONYZ5bHCuA0z0Nwd8Veys5spEAU2uw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784298897; c=relaxed/simple; bh=/06b+9vkLyMtIlYwJJ5CAsugFD9d6Cp+S7GNYmLUxDo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=gKLwY7NEz8XRXAmTdhkfUlbvANeidAmoMICerBEKOkAzJhnAN86tWNkyvXnRGNyo5qIPnJIinQpt5vESt8AZgFEuYxeO1majphbVst5gKMcNAgfHT2Cp1XDwjng0huvAjonsLN96c/xPjeJhDXKvzolTKW6+jyFKlCIe6v8t+7A= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=mndZPh2a; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="mndZPh2a" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3F2951F00A3E; Fri, 17 Jul 2026 14:34:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784298895; bh=+jhCayPhKdoEPi4hYEuWhN+ktJFpA3DV4gThbyJ2nDA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=mndZPh2aTUGOcNVi3fwU81/mclnJQsIzCc2t/4ib1q5L04yxf1/pEBkgLBHgvDm7w 7iRlFpsSgxEjL4DjMxixjgPlnXDNGZgdioe6JtUlujg67bPnVuHa+KgCj9uUZMVSjM kPnC+n6zitVgYGxw3F1jGWbZqlnmemQxoA7g1FIxBZxX7FS9MBdyP1zctfRlgHReqR mGvBqM5IrYquz9rP/d0QvnAMK5LLSdLtw7Bfygy1aU5R8nGvSMKm/60dT1NzoHcC6b 6w2J0XFioG9Nql2VbIbqNL9CT2FlMTonxIpkfkFxVJ++SXjGT7yjmcKhKLVqp1+33B lHUWLF2aiIyEA== From: SJ Park To: Cc: SJ Park , stable@vger.kernel.org, Andrew Morton , Brendan Higgins , David Gow , damon@lists.linux.dev, kunit-dev@googlegroups.com, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org Subject: [RFC PATCH v1.1 6/7] mm/damon/core-kunit: skip wrong quota goal walk in commit_quota_goals() Date: Fri, 17 Jul 2026 07:34:43 -0700 Message-ID: <20260717143445.91207-7-sj@kernel.org> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260717143445.91207-1-sj@kernel.org> References: <20260717143445.91207-1-sj@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" damos_test_commit_quota_goals_for() traverses damos quota goals after damos_commit_quota_goals() call. It assumes damos_commit_quota_goals() made expected numbers of goals. It might not. Because the traversal is made based on destination struct length, it could do out of bounds access for source expectation value array. The consequent user impact (out-of-bound access ) is quite bad. The realistic user impact would be limited though. It would affect only test run setups. Fix it by testing if the number of goals was also changed as expected and exit early for the failure. The issue was discovered [1] by Sashiko. [1] https://lore.kernel.org/20260713144757.39740-1-sj@kernel.org Fixes: d9adfb8a28e7 ("mm/damon/tests/core-kunit: add damos_commit_quota_goa= ls() test") Cc: # 6.19.x Signed-off-by: SJ Park --- mm/damon/tests/core-kunit.h | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h index 9b8c20a50ad53..fbf986aee2dea 100644 --- a/mm/damon/tests/core-kunit.h +++ b/mm/damon/tests/core-kunit.h @@ -839,6 +839,7 @@ static void damos_test_commit_quota_goals_for(struct ku= nit *test, struct damos_quota_goal *goal, *next; bool skip =3D true; int i; + int nr_dst =3D 0, nr_src =3D 0; =20 INIT_LIST_HEAD(&dst.goals); INIT_LIST_HEAD(&src.goals); @@ -861,6 +862,14 @@ static void damos_test_commit_quota_goals_for(struct k= unit *test, =20 damos_commit_quota_goals(&dst, &src); =20 + damos_for_each_quota_goal(goal, &dst) + nr_dst++; + damos_for_each_quota_goal(goal, &src) + nr_src++; + KUNIT_EXPECT_EQ(test, nr_dst, nr_src); + if (nr_dst !=3D nr_src) + goto out; + i =3D 0; damos_for_each_quota_goal(goal, (&dst)) { KUNIT_EXPECT_EQ(test, goal->metric, src_goals[i].metric); --=20 2.47.3 From nobody Sat Jul 25 04:53:33 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1E3C142B75D; Fri, 17 Jul 2026 14:34:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784298897; cv=none; b=owqbE7a0dJyoe3xlheLtYLMv9OL3gdHZxUQN3DOFxGPU30uxWb7DTErNmW/6Pv+wdovcFMDQZE3sKBVja6IsaAGo7rAvaBLmGLjocjxAeDOKUUVhQrYToiANN6uHaLvaH9wajsqFtxYLos94/ZXK3icX+0sLmttkIgEo03Paf/Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784298897; c=relaxed/simple; bh=zOJUHYSF/SfkTCPWN4DkTs3aKPcsBPC82UqmWEWXMmo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=MfqqBMKFNubPDDAjPQCzrHvMJJB56EZ5muJAvpJRNu0qieCUMUUBCIXTtvuPsMRaLLqhkVx6PjhmHyaHXtuFTrp3QPJvsW2usmbNY/X5J0CMZlnOLrtDq7ZoA8RX/GzVLQBeutVnqFyOu6K/kcYJpWVatZzUqXZOECCkFycqYn8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=ICVbrfZK; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="ICVbrfZK" Received: by smtp.kernel.org (Postfix) with ESMTPSA id AFAEE1F00A3A; Fri, 17 Jul 2026 14:34:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784298896; bh=hlaPqrC6aZ24tUVqmNoMgW7uRiUtt18MWvor7D56nnY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=ICVbrfZK6cVoxKsi44Lk4Kn3Gu6CpPdntck4mGTFh7AtJHNjq5PJbquA1SUbvvpjC zeYNGiTp3OLtzdArKhatXEgccYWS3FM53j5VL0enYSv08EWGPfXiihj+W5I//u8lwp j/DAdd+qZyJp0zdgAyyypLGyDFBv/9DaRUzqC3Iog2zT6rkO5eG5JcHg70+VnTm2CG NLpDLqkLRV8BxPP3kMPgfTd0eem0YnEDrwZuKVDoN4bZk/jMNm6W+XiqB0xYXw74mO 4Mj9lF0CzsdGctP0DXaezJsyy1m6/x4JgN+sZy1WBRs2vajYtHZBM96BriXFE9Ur57 XBk4OWMdrOjkg== From: SJ Park To: Cc: SJ Park , stable@vger.kernel.org, Andrew Morton , Brendan Higgins , David Gow , damon@lists.linux.dev, kunit-dev@googlegroups.com, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org Subject: [RFC PATCH v1.1 7/7] mm/damon/core-kunit: skip wrong region walk in commit_target_regions() Date: Fri, 17 Jul 2026 07:34:44 -0700 Message-ID: <20260717143445.91207-8-sj@kernel.org> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260717143445.91207-1-sj@kernel.org> References: <20260717143445.91207-1-sj@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" damon_test_commit_target_regions_for() traverses expected values array after damon_commit_target_regions() call. It assumes damon_commit_target_regions() made expected number of regions. It might not. Because the traversal is made based on the region count, it could do out of bounds access to the expectation value array. The consequent user impact (out-of-bound access) is quite bad. The realistic user impact would be limited, though. It would affect only test run setups. Fix it by testing if the number of regions was also changed as expected and exit early for the failure. The issue was discovered [1] by Sashiko. [1] https://lore.kernel.org/20260713144757.39740-1-sj@kernel.org Fixes: 603f67eb91e0 ("mm/damon/tests/core-kunit: add damon_commit_target_re= gions() test") Cc: # 6.19.x Signed-off-by: SJ Park --- mm/damon/tests/core-kunit.h | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h index fbf986aee2dea..4a536d41cdb2d 100644 --- a/mm/damon/tests/core-kunit.h +++ b/mm/damon/tests/core-kunit.h @@ -1277,14 +1277,19 @@ static void damon_test_commit_target_regions_for(st= ruct kunit *test, kunit_skip(test, "src target setup fail"); } damon_commit_target_regions(dst_target, src_target, 1); + + KUNIT_EXPECT_EQ(test, damon_nr_regions(dst_target), nr_expect_regions); + if (damon_nr_regions(dst_target) !=3D nr_expect_regions) + goto out; + i =3D 0; damon_for_each_region(r, dst_target) { KUNIT_EXPECT_EQ(test, r->ar.start, expect_start_end[i][0]); KUNIT_EXPECT_EQ(test, r->ar.end, expect_start_end[i][1]); i++; } - KUNIT_EXPECT_EQ(test, damon_nr_regions(dst_target), nr_expect_regions); - KUNIT_EXPECT_EQ(test, i, nr_expect_regions); + +out: damon_free_target(dst_target); damon_free_target(src_target); } --=20 2.47.3