Re: [RFC PATCH 03/13] mm/damon/core: use damon_nr_accesses_mvsum() in __damos_valid_target()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Divide-by-zero kernel panic in damon_nr_accesses_mvsum() when aggr_interval is configured to 0.
--

commit 9675c26c9e91a5b3df67520a05b7e2a8a6a589a7
Author: SeongJae Park <sj@kernel.org>

mm/damon/core: use damon_nr_accesses_mvsum() in __damos_valid_target()

This commit modifies __damos_valid_target() to use the helper function
damon_nr_accesses_mvsum() instead of directly reading the nr_accesses_bp
field.

> diff --git a/mm/damon/core.c b/mm/damon/core.c
> index bc8b102d700a7..f45f030a72d82 100644
> --- a/mm/damon/core.c
> +++ b/mm/damon/core.c
> @@ -2118,10 +2118,11 @@ static void kdamond_tune_intervals(struct damon_ctx *c)
>  	damon_set_attrs(c, &new_attrs);
>  }
>  
> -static bool __damos_valid_target(struct damon_region *r, struct damos *s)
> +static bool __damos_valid_target(struct damon_region *r, struct damos *s,
> +		struct damon_ctx *c)
>  {
>  	unsigned long sz;
> -	unsigned int nr_accesses = r->nr_accesses_bp / 10000;
> +	unsigned int nr_accesses = damon_nr_accesses_mvsum(r, c);

[Severity: High]
Does this introduce a divide-by-zero risk if aggr_interval is configured to 0?

If an administrator writes 0 to both sample_us and aggr_us via the
DAMON sysfs interface, damon_set_attrs() allows it because the
validation check (attrs->sample_interval > attrs->aggr_interval)
evaluates to false (0 > 0).

When __damos_valid_target() evaluates active schemes, it now executes
damon_nr_accesses_mvsum(). Inside that function, window_len is calculated
like this:

damon_nr_accesses_mvsum() {
	...
	sample_interval = ctx->attrs.sample_interval ? : 1;
	window_len = ctx->attrs.aggr_interval / sample_interval;
	left_window = ctx->next_aggregation_sis - ctx->passed_sample_intervals;
	left_window_bp = mult_frac(left_window, 10000, window_len);
	...
}

If aggr_interval is 0, window_len evaluates to 0. It is then passed
as the denominator to mult_frac().

Could this result in an exact integer division by zero panic, and should
the zero-values be protected against here or in the configuration interfaces?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260619193415.73833-1-sj@kernel.org?part=3