Re: [RFC PATCH 2/6] mm/damon/core: s/accesses_bp_to_nr_accesses/sample_bp_to_count/

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] 32-bit integer overflow in conversions between basis points (bp) and sample counts due to large number of samples per aggregation interval.
--

--- Patch [2]: [RFC PATCH 2/6] mm/damon/core: s/accesses_bp_to_nr_accesses/sample_bp_to_count/ ---
commit 26f76c0115cf94c7177c6588b38ff64dabf63ab2
Author: SJ Park <sj@kernel.org>

mm/damon/core: s/accesses_bp_to_nr_accesses/sample_bp_to_count/

This commit renames accesses_bp_to_nr_accesses() to
damon_sample_bp_to_count() to better reflect that it converts a samples ratio
(in basis points) to a count. It also updates the callsites and comments to
match the new name.

> diff --git a/mm/damon/core.c b/mm/damon/core.c
> index e710e2789085e..ca530faaa4f83 100644
> --- a/mm/damon/core.c
> +++ b/mm/damon/core.c
> @@ -876,11 +876,11 @@ static unsigned int damon_age_for_new_attrs(unsigned int age,
>  	return age * old_attrs->aggr_interval / new_attrs->aggr_interval;
>  }
>  
> -/* convert access ratio in bp (per 10,000) to nr_accesses */
> -static unsigned int damon_accesses_bp_to_nr_accesses(
> -		unsigned int accesses_bp, struct damon_attrs *attrs)
> +/* convert sample ratio in bp (per 10,000) to count */
> +static unsigned int damon_sample_bp_to_count(
> +		unsigned int bp, struct damon_attrs *attrs)
>  {
> -	return accesses_bp * damon_nr_samples_per_aggr(attrs) / 10000;
> +	return bp * damon_nr_samples_per_aggr(attrs) / 10000;

[Severity: High]
This isn't a bug introduced by this patch, but can the product of bp and
damon_nr_samples_per_aggr() overflow 32 bits?

Since both bp and the return value of damon_nr_samples_per_aggr() are 32-bit
unsigned integers, their product can exceed 32 bits if the number of samples
per aggregation interval is large (greater than ~429,496).

For example, a 1ms sample interval and a 10-minute aggregation interval would
result in 600,000 samples. If bp is 10,000 (100%), the multiplication
10,000 * 600,000 overflows 32 bits to 1,705,032,704, resulting in a truncated
count of 170,503 instead of 600,000.

A similar overflow can occur in damon_nr_accesses_to_accesses_bp() when
evaluating (nr_accesses % nr_samples) * 10000 inside mult_frac() for large
nr_accesses values, falsely marking hot memory as cold.

>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260707043828.97900-1-sj@kernel.org?part=2