[merged mm-stable] mm-damon-core-kunit-skip-wrong-dest-walk-in-commit_dests_for.patch removed from -mm tree

The quilt patch titled
     Subject: mm/damon/core-kunit: skip wrong dest walk in commit_dests_for()
has been removed from the -mm tree.  Its filename was
     mm-damon-core-kunit-skip-wrong-dest-walk-in-commit_dests_for.patch

This patch was dropped because it was merged into the mm-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

------------------------------------------------------
From: SJ Park <[email protected]>
Subject: mm/damon/core-kunit: skip wrong dest walk in commit_dests_for()
Date: Fri, 17 Jul 2026 17:14:39 -0700

damos_test_commit_dests_for() traverse damos action destinations after
damos_commit_dests().  It assumes damos_commit_dests() made expected
numbers of destinations for source and destination structures.  It might
not.  Because the traversal is made based on destination struct length, it
could do out of bounds access for source value expectation.

The consequent user impact (out-of-bound access ) is quite bad.  The
realistic user impact would be limited, though.  It would affect only test
run setups.

Fix it by exiting early for the number of regions test failure.

The issue was discovered [1] by Sashiko.

Link: https://lore.kernel.org/[email protected]
Link: https://lore.kernel.org/[email protected] [1]
Fixes: eec573b8dd65 ("mm/damon/tests/core-kunit: add damos_commit_dests() test")
Signed-off-by: SJ Park <[email protected]>
Cc: Brendan Higgins <[email protected]>
Cc: <[email protected]> # 6.19.x
Signed-off-by: Andrew Morton <[email protected]>
---

 mm/damon/tests/core-kunit.h |    2 ++
 1 file changed, 2 insertions(+)

--- a/mm/damon/tests/core-kunit.h~mm-damon-core-kunit-skip-wrong-dest-walk-in-commit_dests_for
+++ a/mm/damon/tests/core-kunit.h
@@ -1008,6 +1008,8 @@ static void damos_test_commit_dests_for(
 	skip = false;
 
 	KUNIT_EXPECT_EQ(test, dst.nr_dests, src_nr_dests);
+	if (dst.nr_dests != src_nr_dests)
+		goto out;
 	for (i = 0; i < dst.nr_dests; i++) {
 		KUNIT_EXPECT_EQ(test, dst.node_id_arr[i], src_node_id_arr[i]);
 		KUNIT_EXPECT_EQ(test, dst.weight_arr[i], src_weight_arr[i]);
_

Patches currently in -mm which might be from [email protected] are