Re: [RFC PATCH 05/16] mm/damon/core: implement damon_probe_hits_wsum()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The calculation of the weighted sum in `damon_probe_hits_wsum()` can overflow the 32-bit `unsigned int` datatype.
--

commit fa25d0914791f2e39d32d91b9baaf69eaeb0a208
Author: SJ Park <sj@kernel.org>

mm/damon/core: implement damon_probe_hits_wsum()

This commit introduces a new function damon_probe_hits_wsum() to calculate
the weighted sum of probe hits for a given region. This weighted sum is
intended to be used by both users and internal DAMON logic like region
merging.

> diff --git a/mm/damon/core.c b/mm/damon/core.c
> index ec6b099bd8790..c370eaff5795d 100644
> --- a/mm/damon/core.c
> +++ b/mm/damon/core.c
[ ... ]
> @@ -390,6 +390,30 @@ static bool damon_is_last_region(struct damon_region *r,
>  	return list_is_last(&r->list, &t->regions_list);
>  }
>  
> +/**
> + * damon_probe_hits_wsum() - Returns probe hits weighted sum of a region.
> + * @r:		region to get the weigted sum of.
> + * @last:	if the request is for last-window agggregated probe hits.
> + * @ctx:	context of &r.
> + *
> + * Return: the weighted sum of probe hits of the region.
> + */
> +unsigned int damon_probe_hits_wsum(struct damon_region *r, bool last,
> +		struct damon_ctx *ctx)
> +{
> +	struct damon_probe *probe;
> +	unsigned int sum = 0;
> +	int i = 0;
> +
> +	damon_for_each_probe(probe, ctx) {
> +		if (last)
> +			sum += r->last_probe_hits[i++] * probe->weight;
> +		else
> +			sum += r->probe_hits[i++] * probe->weight;

[Severity: Medium]
Can this calculation overflow the 32-bit unsigned integer?

Since sum and probe->weight are both typed as unsigned int, if a
sufficiently large probe weight (for example, larger than 16,843,000) is
configured via sysfs, this multiplication and accumulation might wrap around.

If the score wraps around to an artificially low value, would this cause
DAMON's region merging logic to behave incorrectly due to unexpected
thresholds?

> +	}
> +	return sum;
> +}
> +
>  /*
>   * Check whether a region is intersecting an address range
>   *

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260705205743.98656-1-sj@kernel.org?part=5