[merged mm-stable] mm-damon-core-kunit-skip-wrong-quota-goal-walk-in-commit_quota_goals.patch removed from -mm tree

The quilt patch titled
     Subject: mm/damon/core-kunit: skip wrong quota goal walk in commit_quota_goals()
has been removed from the -mm tree.  Its filename was
     mm-damon-core-kunit-skip-wrong-quota-goal-walk-in-commit_quota_goals.patch

This patch was dropped because it was merged into the mm-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

------------------------------------------------------
From: SJ Park <[email protected]>
Subject: mm/damon/core-kunit: skip wrong quota goal walk in commit_quota_goals()
Date: Fri, 17 Jul 2026 17:14:40 -0700

damos_test_commit_quota_goals_for() traverses damos quota goals after
damos_commit_quota_goals() call.  It assumes damos_commit_quota_goals()
made expected numbers of goals.  It might not.  Because the traversal is
made based on destination struct length, it could do out of bounds access
for source expectation value array.

The consequent user impact (out-of-bound access ) is quite bad.  The
realistic user impact would be limited though.  It would affect only test
run setups.

Fix it by testing if the number of goals was also changed as expected and
exit early for the failure.

The issue was discovered [1] by Sashiko.

Link: https://lore.kernel.org/[email protected]
Link: https://lore.kernel.org/[email protected] [1]
Fixes: d9adfb8a28e7 ("mm/damon/tests/core-kunit: add damos_commit_quota_goals() test")
Signed-off-by: SJ Park <[email protected]>
Cc: Brendan Higgins <[email protected]>
Cc: <[email protected]> # 6.19.x
Signed-off-by: Andrew Morton <[email protected]>
---

 mm/damon/tests/core-kunit.h |    9 +++++++++
 1 file changed, 9 insertions(+)

--- a/mm/damon/tests/core-kunit.h~mm-damon-core-kunit-skip-wrong-quota-goal-walk-in-commit_quota_goals
+++ a/mm/damon/tests/core-kunit.h
@@ -839,6 +839,7 @@ static void damos_test_commit_quota_goal
 	struct damos_quota_goal *goal, *next;
 	bool skip = true;
 	int i;
+	int nr_dst = 0, nr_src = 0;
 
 	INIT_LIST_HEAD(&dst.goals);
 	INIT_LIST_HEAD(&src.goals);
@@ -861,6 +862,14 @@ static void damos_test_commit_quota_goal
 
 	damos_commit_quota_goals(&dst, &src);
 
+	damos_for_each_quota_goal(goal, &dst)
+		nr_dst++;
+	damos_for_each_quota_goal(goal, &src)
+		nr_src++;
+	KUNIT_EXPECT_EQ(test, nr_dst, nr_src);
+	if (nr_dst != nr_src)
+		goto out;
+
 	i = 0;
 	damos_for_each_quota_goal(goal, (&dst)) {
 		KUNIT_EXPECT_EQ(test, goal->metric, src_goals[i].metric);
_

Patches currently in -mm which might be from [email protected] are