From nobody Sat Jul 25 04:53:33 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 45273DF6C; Sat, 18 Jul 2026 00:14:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784333686; cv=none; b=k5sVAOG7rsI3JVqtVdn7ZEWRtB25vRd5TytjHuko+fdVlhvy5rJByGuIlHy9ZAggKoQmUW9FDvCaE0tTecFl4gpYDjgkKZiY6weCHDh203IK+cZf4fdMswPiljMr3syDf/dNoVtgzwynxgmcxhp3ebYTPioPVmvdo9etWD9nCfI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784333686; c=relaxed/simple; bh=ioC4eodbAR+1Uyfpuko2Zd0ZkrM7igoZy/SFuML6ORE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=RxAvxexIVlrTp+fmHoWyl25Z8D0qHmFtbYhydvesak7279gonFXnE0G5AAaqmC76bBTBNUmOj8McLmFUgc5JHRQt4OWZcO+NeeV0xgKLl+85eOgfElXNNuoqr4Qz5xDNUOps8iTNoafgAhpyKVYfTWcgTmWpcCogzh5MBcioH3Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=FOruMsKP; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="FOruMsKP" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A24751F00A3D; Sat, 18 Jul 2026 00:14:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784333685; bh=jqlH4wneWbMAf8JjBiLX1bTl/sVQqX7skPWoj8yoesY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=FOruMsKPL/U3XY9juZDN9avo76TDPTcJuXwXWUDQNx8Yz+18QegNmp+QCoET+Rve+ NwhddX+KuULp9o1ExaNTrovDAYYumb1NZqg8DK9VqS2FPbLqkQmSfprMv1KCNig6wl bIMbznAwMck0z+azzhMkY6wFQsVOqXylEfvwS7yRD1epID098fb2au4ckVpiHgZSLY gdY3MVjga6mdI5W/oGjg400pFHzJSzXGqNof9sO9SnMNbe9WLzPlNY4o3bMKI0FadV BuAguxsV+avV1NBkQMuskVRVYFKBmApqU5rAR9oViuufNM+2UKc2GkJl2D6HU05OS5 Zp/Yw4rUuDYQw== From: SJ Park To: Andrew Morton Cc: SJ Park , stable@vger.kernel.org, Brendan Higgins , David Gow , damon@lists.linux.dev, kunit-dev@googlegroups.com, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org Subject: [PATCH 1/7] mm/damon/core: initialize damos->last_applied Date: Fri, 17 Jul 2026 17:14:35 -0700 Message-ID: <20260718001442.87129-2-sj@kernel.org> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260718001442.87129-1-sj@kernel.org> References: <20260718001442.87129-1-sj@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Multiple DAMON regions could exist across a folio. If they fulfill the condition to apply a DAMOS scheme, the scheme could be applied multiple times to the folio. To avoid this, each DAMOS scheme stores the folio that the scheme was applied to last time in the damos->last_applied field and skips repeatedly applying the same scheme to the same folio. The field is being used without initialization, though. Hence, the mechanism could wrongly skip applying a scheme to a folio at the very first time of DAMOS run. The user impact is trivial. DAMON might unexpectedly skip applying DAMOS action for one folio for the first time per scheme. In the DAMON's best-effort world, this is never a real problem. No critical consequences such as kernel panic or memory corruption happen. It is a clear bug, though, and the fix is straightforward. Fix the issue by initializing the field in DAMOS scheme creation function, damon_new_scheme(). The issue was discovered [1] by Sashiko. [1] https://lore.kernel.org/20260714055436.120034-1-sj@kernel.org Fixes: 94ba17adaba0 ("mm/damon: avoid applying DAMOS action to same entity = multiple times") Cc: # 6.15.x Signed-off-by: SJ Park --- mm/damon/core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/mm/damon/core.c b/mm/damon/core.c index f464b4f0976c3..60255f5cd715e 100644 --- a/mm/damon/core.c +++ b/mm/damon/core.c @@ -705,6 +705,7 @@ struct damos *damon_new_scheme(struct damos_access_patt= ern *pattern, INIT_LIST_HEAD(&scheme->ops_filters); scheme->stat =3D (struct damos_stat){}; scheme->max_nr_snapshots =3D 0; + scheme->last_applied =3D NULL; INIT_LIST_HEAD(&scheme->list); =20 scheme->quota =3D *(damos_quota_init(quota)); --=20 2.47.3 From nobody Sat Jul 25 04:53:33 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 993D0EEBB; Sat, 18 Jul 2026 00:14:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784333686; cv=none; b=Xjwlm5veao6VZ/FM3z0aXgjVj4pcun4dx9nkbRMwWesY8483GaDgLZp9QwpcmrxqoS22oZhxMSf20i9gbUN9jzodqW3bWb/Bfc6I7HDOfMj582OtJ4XjnWad7PUUBeK4BxkHkrmnzUFdDm28eiKAzIs8nkA6Y8wjMDfEkNcpu8w= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784333686; c=relaxed/simple; bh=A6BGFjnrb0sGxm4ySrgUnFdjJrEj1Y+uBT36j939Xnw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=OwPAHqbnMJOu+y6wJPJofuPww+0NWzLH+uTyYs0vX/lMtfA4JvLjUf42q9BZ9cA/XHJMgeQ43qMh/Ra3PwhN/pwp9CRdtStw3xCRfZdlE40reTJdlHr5uE8WF5xvCOX6nw/kIwFTPSLdTUBEEDpZCBs3nm2+YOgfzeQJeXc1WtU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=ZvgYV8nZ; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="ZvgYV8nZ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 237C31F00A3E; Sat, 18 Jul 2026 00:14:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784333685; bh=KyQzh9cAgWHiv+f51XfecFAFsLqN9MeOR+zzeRidaFs=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=ZvgYV8nZPh0Vs1e2HWmXBKovRq0Q3KTToigGphwSzwA2cJWWfN7ore4sH905Gw0ov FXzFVC/n/hY9EC1AhYH4jO0MfoA/h9nvdyRFi1NWFwJFPvVuLjDs4db3V4mzkfeAT/ HwsF9mGbmafyJDwVY/osoUqOWNLphNkQZ7I8drngm/DrT8ckGOzGltlIFAVVRbWmC4 r8yxuIByONYDUB1G1Zf/RbqlaIgXszwzFHzLC2uXK4cTxPmR7jmyuqU/UJUWqRE33s ls7VImQlsPN6pvlnjyDWKnhBlktzvnuBgXBW1i8jo30Iaiyz+gfNfZYfV3RYjuas0o 7GyiRuCsclNcw== From: SJ Park To: Andrew Morton Cc: SJ Park , stable@vger.kernel.org, Brendan Higgins , David Gow , SeongJae Park , damon@lists.linux.dev, kunit-dev@googlegroups.com, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org Subject: [PATCH 2/7] mm/damon/core-kunit: check region count before testing in split_at() Date: Fri, 17 Jul 2026 17:14:36 -0700 Message-ID: <20260718001442.87129-3-sj@kernel.org> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260718001442.87129-1-sj@kernel.org> References: <20260718001442.87129-1-sj@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" damon_test_split_at() test next region that is assumed to be created by damon_split_region_at() invocation. But the split might fail. In this case, the succeeding test may dereference invalid pointers returned by damon_next_region(). The invalid pointer may not cause a really bad user impact, because of the implementation detail. It would only read wrong contents in the belonging damon_target struct. Depending on the future change of the offset from the link header to the accessing field, this could also be really dangerous, though. Still, the realistic user impact would be limited. It would affect only test run setups. Fix it by testing if the number of regions was also changed as expected and exit early for the failure. The issue was discovered [1] by Sashiko. [1] https://lore.kernel.org/20260714142352.100478-1-sj@kernel.org Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests") Cc: # 5.15.x Signed-off-by: SJ Park --- mm/damon/tests/core-kunit.h | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h index eba643762132f..322a295ac2cec 100644 --- a/mm/damon/tests/core-kunit.h +++ b/mm/damon/tests/core-kunit.h @@ -155,6 +155,10 @@ static void damon_test_split_at(struct kunit *test) r->age =3D 10; damon_add_region(r, t); damon_split_region_at(t, r, 25); + KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 2); + if (damon_nr_regions(t) !=3D 2) + goto out; + KUNIT_EXPECT_EQ(test, r->ar.start, 0ul); KUNIT_EXPECT_EQ(test, r->ar.end, 25ul); =20 @@ -166,6 +170,7 @@ static void damon_test_split_at(struct kunit *test) KUNIT_EXPECT_EQ(test, r->last_nr_accesses, r_new->last_nr_accesses); KUNIT_EXPECT_EQ(test, r->age, r_new->age); =20 +out: damon_free_target(t); } =20 --=20 2.47.3 From nobody Sat Jul 25 04:53:33 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 43B1729405; Sat, 18 Jul 2026 00:14:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784333687; cv=none; b=pYBaBsVRfY7fbf5kZNw/QFjNUQNrLPN3Or4CQ802+Yz/sU82yeGqbJaXX8uGSxhXnlutUiyVlIOoC8iN+vP++T/PjwXekFj4QK7V/R2c1jRQry1egdhjTQX7G1E1QRh2NWKhmskh3hKbuRCUEXP+fciajKrkdUeb5dTaC38B1+E= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784333687; c=relaxed/simple; bh=m0vrFx60LsajtXXWvXeyGJ4ELnn46NTe35fJet7iEZI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=SsgUPMyfEsFDFGv/zB2WiK6Qtz7RcWR5Ae9XncGY36d8c0vLFbYerw1+umfObZGL+Wo0gx8FNdeG50WmRMSNlw+7YDJ1+zIsUEW95EpEHYZCyM6ZOaTEDaHXsxu48o4+iT0dGymsiM8USKsFuQMq8939b8HC4Bp/CbyJAu8qADY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Dk5Y5mnL; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Dk5Y5mnL" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A10E51F00A3A; Sat, 18 Jul 2026 00:14:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784333686; bh=BYUt77gOaLnD9RIh57O9y6iLCV8DgyWvyhX78FkqqnI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Dk5Y5mnL4n9nX/qD+riWA/ocT3wlzIvV64mCeq4BIDPZnxhLoxScdDhMwdgNFf7zF 2iA2J60FRi0QCcK9b/Ev3kZn6isdq6kJon5KOwDi1aXFlthjXVHBdMcaO4pe/GSl2S WdXeCd/lBbclbCT+ttbP9Vv7ictIL/0tNSMQcdiWd0zj0RD4ayuhATuniAyn4W0pWo CY5xNFiqvWohcGTK/G6HGuUkRaSea9ew6LC4ldMnjwmdvKLpN/6SUd3aOyC//s3a9l OS0a2uoubtWa0f+1KwryUzcHcrv0xMKGY9cDmLyCKWKB2tDcK5qriW2xupwwAM8y9A N+JY9ISM6Qb7w== From: SJ Park To: Andrew Morton Cc: SJ Park , stable@vger.kernel.org, Brendan Higgins , David Gow , SeongJae Park , damon@lists.linux.dev, kunit-dev@googlegroups.com, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org Subject: [PATCH 3/7] mm/damon/vaddr-kunit: check region count in three_regions test Date: Fri, 17 Jul 2026 17:14:37 -0700 Message-ID: <20260718001442.87129-4-sj@kernel.org> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260718001442.87129-1-sj@kernel.org> References: <20260718001442.87129-1-sj@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" damon_do_test_apply_three_regions() iterates regions after damon_set_regions() call assuming the function would succeed at setting the number of regions the same to the expected one. It might have failed. In this case, __nth_region_of() in the iteration could return NULL and NULL dereference can happen in the test. The consequent user impact (NULL dereference) is quite bad. The realistic user impact would be limited, though. It would affect only test run setups. Fix it by testing if the number of regions was also changed as expected and exit early for the failure. The issue was discovered [1] by Sashiko. [1] https://lore.kernel.org/20260713144757.39740-1-sj@kernel.org Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests") Cc: # 5.15.x Signed-off-by: SJ Park --- mm/damon/tests/vaddr-kunit.h | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/mm/damon/tests/vaddr-kunit.h b/mm/damon/tests/vaddr-kunit.h index 61f844336ffb5..6a95441d193ae 100644 --- a/mm/damon/tests/vaddr-kunit.h +++ b/mm/damon/tests/vaddr-kunit.h @@ -158,12 +158,17 @@ static void damon_do_test_apply_three_regions(struct = kunit *test, kunit_skip(test, "second damon_set_regions() fail"); } =20 + KUNIT_EXPECT_EQ(test, damon_nr_regions(t), nr_expected / 2); + if (damon_nr_regions(t) !=3D nr_expected / 2) + goto out; + for (i =3D 0; i < nr_expected / 2; i++) { r =3D __nth_region_of(t, i); KUNIT_EXPECT_EQ(test, r->ar.start, expected[i * 2]); KUNIT_EXPECT_EQ(test, r->ar.end, expected[i * 2 + 1]); } =20 +out: damon_destroy_target(t, NULL); } =20 --=20 2.47.3 From nobody Sat Jul 25 04:53:33 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8FCDF3C07A; Sat, 18 Jul 2026 00:14:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784333687; cv=none; b=FjMKX/Fr18HZNTfT6mXab6oDQkeGtJQU1vEVaMyOArx6qGo4I9bwTWzb5yKX8AgKyIktIitc9B2r2VzU9cjBr0ceqYtJ5otQZFhttA5Uu0BGL+ORZ2Xw6emxYYUDDRDrwZY6A/M7bWd8ToLV4dq7xSub+zg6+CHOaai+vEoeLys= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784333687; c=relaxed/simple; bh=ILjTYHuIfdw7uvX4Y1fhjhJEasaEw8iiRHuJ4SiGEnQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=dtAOr7WvWxsHpYgZFA8JRXLidAGQCgSMF0xPYpeAlxgG8mQJRlFYcUa3DuLtueo0muhVA7x4o5xSRdFfF8wc6NZVkDlhgIqL8j9NI7Ox1iMbu93XUA+9xuTi9GFCKDP2gdTY9/DHUPpGqKpBPTKQKL+V6CZCaWj3Pz62V54YwOQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=eCj3AtKT; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="eCj3AtKT" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 28C181F000E9; Sat, 18 Jul 2026 00:14:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784333686; bh=cUz2au4OyIrV9kPXUAznd25PGFTMj7HneR6m36jCxn4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=eCj3AtKTOWh8nwQAmfmA+VQ82bpReRimwkqApgoi4pVQ/HsvlN+yZHblj8TcRlGUw tDETKiD2M6IRi5Q5yjrpbxdAaCASAGdrussfsQabdATc0B8ncyq49ArJGyb4dP87IE OpEELBOety5Bg0/VDJ1OUn01wVfVpdcrHGQqVVY/8TQ1Vl6cbfPQ9jmI6865zaqwmY kKrocI7c3gHhWJUiZZwZTH86jQQ6kH469emNKPNBU+Lvhk1Q4r/VIU2b2EfC5Ab4L5 lkEW5JzgBD+gPRMUdbYXfXYE1ypd0V5GZHUNcr5ohFmRl/tjlMX6La3brUOTWbZ5NU o2C5ggz61+K4A== From: SJ Park To: Andrew Morton Cc: SJ Park , stable@vger.kernel.org, Brendan Higgins , David Gow , damon@lists.linux.dev, kunit-dev@googlegroups.com, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org Subject: [PATCH 4/7] mm/damon/core-kunit: handle region split failure in filter_out() Date: Fri, 17 Jul 2026 17:14:38 -0700 Message-ID: <20260718001442.87129-5-sj@kernel.org> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260718001442.87129-1-sj@kernel.org> References: <20260718001442.87129-1-sj@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" dasmon_test_filter_out() test checks if damos_filter_match() of an address filter splits the region as expected under a given condition. But, the test continued regardless of the split successes. As a result, the later part of the test could dereference invalid pointers that returned from damon_next_region(). Further, it could corrupt memory from damon_destroy_region(). The consequent user impact (memory corruption) is quite bad. The realistic user impact would be limited, though. It would affect only test run setups. Fix it by exiting early for the number of regions test failure. The issue was discovered [1] by Sashiko. [1] https://lore.kernel.org/20260714142352.100478-1-sj@kernel.org Fixes: 26713c890875 ("mm/damon/core-test: add a unit test for __damos_filte= r_out()") Cc: # 6.6.x Signed-off-by: SJ Park --- mm/damon/tests/core-kunit.h | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h index 322a295ac2cec..eddf3a0484583 100644 --- a/mm/damon/tests/core-kunit.h +++ b/mm/damon/tests/core-kunit.h @@ -1365,6 +1365,8 @@ static void damos_test_filter_out(struct kunit *test) KUNIT_EXPECT_EQ(test, r->ar.start, 1); KUNIT_EXPECT_EQ(test, r->ar.end, 2); KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 2); + if (damon_nr_regions(t) !=3D 2) + goto out; r2 =3D damon_next_region(r); KUNIT_EXPECT_EQ(test, r2->ar.start, 2); KUNIT_EXPECT_EQ(test, r2->ar.end, 4); @@ -1379,11 +1381,14 @@ static void damos_test_filter_out(struct kunit *tes= t) KUNIT_EXPECT_EQ(test, r->ar.start, 2); KUNIT_EXPECT_EQ(test, r->ar.end, 6); KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 2); + if (damon_nr_regions(t) !=3D 2) + goto out; r2 =3D damon_next_region(r); KUNIT_EXPECT_EQ(test, r2->ar.start, 6); KUNIT_EXPECT_EQ(test, r2->ar.end, 8); damon_destroy_region(r2, t); =20 +out: damon_free_target(t); damos_free_filter(f); } --=20 2.47.3 From nobody Sat Jul 25 04:53:33 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4C43217BA2; Sat, 18 Jul 2026 00:14:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784333688; cv=none; b=Jug6Ssioztc8iJc1y6+wzrhxE71kaxO2p+H+CjATEEGqqxuE16ZA81cOEu0RWhXqdLlYYVOFw3yIp0hFGxPVRBEIllGwvaaHIZvC1m8NATvFm9nwBHiWD/DHZSePis57XttZkB2PkZUNsEWDzD8jFB8S/e3YCbrXS5geDHdQzSU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784333688; c=relaxed/simple; bh=6cVktXVE8rSuUMJmgI4PsGketuF/LIliSMcwhDwymn4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=duXSftHgVdNkIZZP/bh3G0yuc5nHVtyQ88vjuGhc09WCOE8GtgKkZnx0sWhL7V1lV207nAFDjAzRkKn1bQNbYEDd0/GV3DFxZ+d4yaB769dSAHB9ivK9Ibke/Nm+LYiH6Dggb3j82XKIbhX00wBPTWamx00Qivxo0MLNyHSS3fs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=eEiU48dQ; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="eEiU48dQ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9E5D71F00A3D; Sat, 18 Jul 2026 00:14:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784333687; bh=VuPFx8TTNBzLXDK2qKBdCiBzn3J3hO3HBSaJVXSFOsw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=eEiU48dQasMg4plbYEWGNgKVXJ5EpuET9reLcOHgUZc/673efrBRai0hWabxe9XhO A6jsgZ9ZXiEFpmf8ku/81CuxtgTVkf00XX8dF2vZRV61SJuqfYbhzL4r7Jt6rk806i miduKUOtGaIMwB+rY8c8DRkQKoTIDASZ7RlRZkaGgVAl8XkUOhvl+M98n2J3pKEmdB 1HAeQUfI5xAOZiL4dhbW/6oUq2CzsRrb8RCcwcxrBYfdjyIZqT0m8o0VHquzWxFwi8 v3s/cTEElQySXsW+N5kft/xyq0LX8WjmSgbiC9oRm3yP1J4WgluIovftrTz19V7Usg AtBsEX8sXX+ng== From: SJ Park To: Andrew Morton Cc: SJ Park , stable@vger.kernel.org, Brendan Higgins , David Gow , damon@lists.linux.dev, kunit-dev@googlegroups.com, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org Subject: [PATCH 5/7] mm/damon/core-kunit: skip wrong dest walk in commit_dests_for() Date: Fri, 17 Jul 2026 17:14:39 -0700 Message-ID: <20260718001442.87129-6-sj@kernel.org> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260718001442.87129-1-sj@kernel.org> References: <20260718001442.87129-1-sj@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" damos_test_commit_dests_for() traverse damos action destinations after damos_commit_dests(). It assumes damos_commit_dests() made expected numbers of destinations for source and destination structures. It might not. Because the traversal is made based on destination struct length, it could do out of bounds access for source value expectation. The consequent user impact (out-of-bound access ) is quite bad. The realistic user impact would be limited, though. It would affect only test run setups. Fix it by exiting early for the number of regions test failure. The issue was discovered [1] by Sashiko. [1] https://lore.kernel.org/20260713144757.39740-1-sj@kernel.org Fixes: eec573b8dd65 ("mm/damon/tests/core-kunit: add damos_commit_dests() t= est") Cc: # 6.19.x Signed-off-by: SJ Park --- mm/damon/tests/core-kunit.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h index eddf3a0484583..9b8c20a50ad53 100644 --- a/mm/damon/tests/core-kunit.h +++ b/mm/damon/tests/core-kunit.h @@ -1008,6 +1008,8 @@ static void damos_test_commit_dests_for(struct kunit = *test, skip =3D false; =20 KUNIT_EXPECT_EQ(test, dst.nr_dests, src_nr_dests); + if (dst.nr_dests !=3D src_nr_dests) + goto out; for (i =3D 0; i < dst.nr_dests; i++) { KUNIT_EXPECT_EQ(test, dst.node_id_arr[i], src_node_id_arr[i]); KUNIT_EXPECT_EQ(test, dst.weight_arr[i], src_weight_arr[i]); --=20 2.47.3 From nobody Sat Jul 25 04:53:33 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8159815E5BB; Sat, 18 Jul 2026 00:14:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784333688; cv=none; b=e00GuLrabFD1XBqQ8ds/uGXtOYKt2quTLBgcyWCrfa94E7LmbyhDLnOoI0gLr44L7WG/ODJTeUGBsgbLfk89CXI/3eMIObs5+xSwp1ndtp0cDaCjsdwklE7TanjQum74vKQc5AXY7H3fK3sHPhA+ahdN/vdAC81zh11SuGlG60I= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784333688; c=relaxed/simple; bh=/06b+9vkLyMtIlYwJJ5CAsugFD9d6Cp+S7GNYmLUxDo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=oj9uVijRLPOMpeeJxvdNhLqy+k5IrQT0rEfACNWkpRwBGMHRAAUcbop9CLiTzhtyQ36IBbgL7Vgka1YrAz4euDmaMdYWYpExAaGKsxmTnaM+0LEckC1aJMOq/3TVrYFsOuLG4LPNdIdKVxbCMicFRycwvB9HHpKacmOnkaVreBE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=bdUsS8ZX; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="bdUsS8ZX" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1BCE41F00A3E; Sat, 18 Jul 2026 00:14:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784333687; bh=+jhCayPhKdoEPi4hYEuWhN+ktJFpA3DV4gThbyJ2nDA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=bdUsS8ZXnttW3GnYu1ABomdOLnq+jg3jHJG/BCjbz4e748+3cYBwH8weP9YAFgIyR U2pqINgBD41IX6f5UdR20qv0wC/DOPgKXgff1L7470+Stu+Jc/SPTu8SJXP2ADT8pw 7uU6q+UBncqf2/DSD5oB03y+AH9dJzznTdQNLNKsFy5Euz+D4cJyPWfFRGaTN9kY91 4OCRKPWi+mAHicPo21tfSdOT2FFCmAh0UgnnR+rtGogBG1PuJUMafsYiqK5R3528EU BQ4+6Z+DEorzNYkl2gc9MlfR/WwmasRXOVi9mKN2pJMKwe97lIvzdSB+mcq1xIUv+x 6pCYOmjLZgH1A== From: SJ Park To: Andrew Morton Cc: SJ Park , stable@vger.kernel.org, Brendan Higgins , David Gow , damon@lists.linux.dev, kunit-dev@googlegroups.com, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org Subject: [PATCH 6/7] mm/damon/core-kunit: skip wrong quota goal walk in commit_quota_goals() Date: Fri, 17 Jul 2026 17:14:40 -0700 Message-ID: <20260718001442.87129-7-sj@kernel.org> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260718001442.87129-1-sj@kernel.org> References: <20260718001442.87129-1-sj@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" damos_test_commit_quota_goals_for() traverses damos quota goals after damos_commit_quota_goals() call. It assumes damos_commit_quota_goals() made expected numbers of goals. It might not. Because the traversal is made based on destination struct length, it could do out of bounds access for source expectation value array. The consequent user impact (out-of-bound access ) is quite bad. The realistic user impact would be limited though. It would affect only test run setups. Fix it by testing if the number of goals was also changed as expected and exit early for the failure. The issue was discovered [1] by Sashiko. [1] https://lore.kernel.org/20260713144757.39740-1-sj@kernel.org Fixes: d9adfb8a28e7 ("mm/damon/tests/core-kunit: add damos_commit_quota_goa= ls() test") Cc: # 6.19.x Signed-off-by: SJ Park --- mm/damon/tests/core-kunit.h | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h index 9b8c20a50ad53..fbf986aee2dea 100644 --- a/mm/damon/tests/core-kunit.h +++ b/mm/damon/tests/core-kunit.h @@ -839,6 +839,7 @@ static void damos_test_commit_quota_goals_for(struct ku= nit *test, struct damos_quota_goal *goal, *next; bool skip =3D true; int i; + int nr_dst =3D 0, nr_src =3D 0; =20 INIT_LIST_HEAD(&dst.goals); INIT_LIST_HEAD(&src.goals); @@ -861,6 +862,14 @@ static void damos_test_commit_quota_goals_for(struct k= unit *test, =20 damos_commit_quota_goals(&dst, &src); =20 + damos_for_each_quota_goal(goal, &dst) + nr_dst++; + damos_for_each_quota_goal(goal, &src) + nr_src++; + KUNIT_EXPECT_EQ(test, nr_dst, nr_src); + if (nr_dst !=3D nr_src) + goto out; + i =3D 0; damos_for_each_quota_goal(goal, (&dst)) { KUNIT_EXPECT_EQ(test, goal->metric, src_goals[i].metric); --=20 2.47.3 From nobody Sat Jul 25 04:53:33 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 04AB318B0A; Sat, 18 Jul 2026 00:14:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784333689; cv=none; b=MJcMx5orhflxeZLNCwCubILTbYyHYINWseDX40kLYENXan7EpR63L+lo+TaA0M3zi0OGZKBLaoVPtz0DwzW3/OX+z8iWrDC84lfg/i6ewWYRMiA8s29IJCRvUEtFOYz7tYRApAkXAXA9CWBc5TaPz+dEitVxdnllPcGPKA0AWWM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784333689; c=relaxed/simple; bh=zOJUHYSF/SfkTCPWN4DkTs3aKPcsBPC82UqmWEWXMmo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=K7XMY9qWo+D88bIXVlBZZ4sXsWvNRQ/q31gH8kiVgMlv0ykD0Gfxc7WimH+bOe0Z2yp1IJdMS+qn3SNqL0vW98cAKIuKlJl197tzVXWS2ZNP+OD11BEhomQKijAKGoDwlslNcR7jGmJx6JhncyMniQBfdKeRbR7Qst3dPjTdvxo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=DcZST0Jy; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="DcZST0Jy" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9137D1F00A3A; Sat, 18 Jul 2026 00:14:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784333687; bh=hlaPqrC6aZ24tUVqmNoMgW7uRiUtt18MWvor7D56nnY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=DcZST0JyZ+VsKqU9PvOID36E9CRrNSLnOGd8EFTWxNPgb/FkFEKw7G8fsXiPmcgtU Aw8pWXa/P+qt01XtysDSejd52LvREX3r51PgldBJAJkTI55yAnH92FgrZ0CkdVMnEb Vu6V6vKTRiMWDLz7evQItMSQZ5WPpAMRxFipilfAbj4fr7j+FmkqR18ef4u5lr6AoU b6fKlaC1YHNFVRf+en/jSKYQRAz6xfr3IJm/QmICHoIjDEfiRK5f1OGbBQy4v3NswL lStie6B8ySy71K8yKxdIn6i2qT1+Ok/VKVQ/N0o0O3PaqT+qtPQLncD3da9gsrxScq UjnGKstrcxxVg== From: SJ Park To: Andrew Morton Cc: SJ Park , stable@vger.kernel.org, Brendan Higgins , David Gow , damon@lists.linux.dev, kunit-dev@googlegroups.com, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org Subject: [PATCH 7/7] mm/damon/core-kunit: skip wrong region walk in commit_target_regions() Date: Fri, 17 Jul 2026 17:14:41 -0700 Message-ID: <20260718001442.87129-8-sj@kernel.org> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260718001442.87129-1-sj@kernel.org> References: <20260718001442.87129-1-sj@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" damon_test_commit_target_regions_for() traverses expected values array after damon_commit_target_regions() call. It assumes damon_commit_target_regions() made expected number of regions. It might not. Because the traversal is made based on the region count, it could do out of bounds access to the expectation value array. The consequent user impact (out-of-bound access) is quite bad. The realistic user impact would be limited, though. It would affect only test run setups. Fix it by testing if the number of regions was also changed as expected and exit early for the failure. The issue was discovered [1] by Sashiko. [1] https://lore.kernel.org/20260713144757.39740-1-sj@kernel.org Fixes: 603f67eb91e0 ("mm/damon/tests/core-kunit: add damon_commit_target_re= gions() test") Cc: # 6.19.x Signed-off-by: SJ Park --- mm/damon/tests/core-kunit.h | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h index fbf986aee2dea..4a536d41cdb2d 100644 --- a/mm/damon/tests/core-kunit.h +++ b/mm/damon/tests/core-kunit.h @@ -1277,14 +1277,19 @@ static void damon_test_commit_target_regions_for(st= ruct kunit *test, kunit_skip(test, "src target setup fail"); } damon_commit_target_regions(dst_target, src_target, 1); + + KUNIT_EXPECT_EQ(test, damon_nr_regions(dst_target), nr_expect_regions); + if (damon_nr_regions(dst_target) !=3D nr_expect_regions) + goto out; + i =3D 0; damon_for_each_region(r, dst_target) { KUNIT_EXPECT_EQ(test, r->ar.start, expect_start_end[i][0]); KUNIT_EXPECT_EQ(test, r->ar.end, expect_start_end[i][1]); i++; } - KUNIT_EXPECT_EQ(test, damon_nr_regions(dst_target), nr_expect_regions); - KUNIT_EXPECT_EQ(test, i, nr_expect_regions); + +out: damon_free_target(dst_target); damon_free_target(src_target); } --=20 2.47.3