Re: [RFC PATCH v1.3 07/18] mm/damon/sysfs-schemes: use damon_nr_accesses_mvsum() for damo regions

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Integer overflow in `mult_frac` on 32-bit architectures when calculating `left_window_bp` in `damon_nr_accesses_mvsum()`.
--

commit 3dcb4c6bbc65644874c65412bf73b8673d929524
Author: SeongJae Park <sj@kernel.org>

mm/damon/sysfs-schemes: use damon_nr_accesses_mvsum() for damo regions

This commit switches the DAMON sysfs interface to use damon_nr_accesses_mvsum()
instead of nr_accesses_bp for scheme-tried regions. The new function is chosen
to be simpler and more tolerant to errors.

> diff --git a/mm/damon/sysfs-schemes.c b/mm/damon/sysfs-schemes.c
> index 329cfd0bbe9f3..e648b0f809332 100644
> --- a/mm/damon/sysfs-schemes.c
> +++ b/mm/damon/sysfs-schemes.c
> @@ -167,7 +167,7 @@ static struct damon_sysfs_scheme_region *damon_sysfs_scheme_region_alloc(
>  		return NULL;
>  	sysfs_region->kobj = (struct kobject){};
>  	sysfs_region->ar = region->ar;
> -	sysfs_region->nr_accesses = region->nr_accesses_bp / 10000;
> +	sysfs_region->nr_accesses = damon_nr_accesses_mvsum(region, ctx);

[Severity: High]
By switching to damon_nr_accesses_mvsum(), does this expose a 32-bit
integer overflow when calculating left_window_bp?

Inside damon_nr_accesses_mvsum() in mm/damon/core.c, the mult_frac(x, n, d)
macro evaluates (x % d) * n / d using typeof(x), which is unsigned long for
left_window:

mm/damon/core.c:damon_nr_accesses_mvsum() {
    ...
    left_window_bp = mult_frac(left_window, 10000, window_len);
    ...
}

If window_len (derived from aggr_interval / sample_interval) exceeds
429,496, multiplying (left_window % window_len) by 10,000 can exceed
4,294,967,295. On 32-bit architectures, this silently overflows the
unsigned long maximum value.

This corrupted count would now be exposed to sysfs here, and it also affects
DAMOS scheme applications in __damos_valid_target(), potentially leading to
incorrect memory reclaim or migrations.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260622142139.30269-1-sj@kernel.org?part=7