Re: [RFC PATCH 05/16] mm/damon/core: implement damon_probe_hits_wsum()

[SJ Park <sj@kernel.org>]

On Sun, 05 Jul 2026 21:13:50 +0000 sashiko-bot@kernel.org wrote:

> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] The calculation of the weighted sum in `damon_probe_hits_wsum()` can overflow the 32-bit `unsigned int` datatype.
> --
> 
> commit fa25d0914791f2e39d32d91b9baaf69eaeb0a208
> Author: SJ Park <sj@kernel.org>
> 
> mm/damon/core: implement damon_probe_hits_wsum()
> 
> This commit introduces a new function damon_probe_hits_wsum() to calculate
> the weighted sum of probe hits for a given region. This weighted sum is
> intended to be used by both users and internal DAMON logic like region
> merging.
> 
> > diff --git a/mm/damon/core.c b/mm/damon/core.c
> > index ec6b099bd8790..c370eaff5795d 100644
> > --- a/mm/damon/core.c
> > +++ b/mm/damon/core.c
> [ ... ]
> > @@ -390,6 +390,30 @@ static bool damon_is_last_region(struct damon_region *r,
> >  	return list_is_last(&r->list, &t->regions_list);
> >  }
> >  
> > +/**
> > + * damon_probe_hits_wsum() - Returns probe hits weighted sum of a region.
> > + * @r:		region to get the weigted sum of.
> > + * @last:	if the request is for last-window agggregated probe hits.
> > + * @ctx:	context of &r.
> > + *
> > + * Return: the weighted sum of probe hits of the region.
> > + */
> > +unsigned int damon_probe_hits_wsum(struct damon_region *r, bool last,
> > +		struct damon_ctx *ctx)
> > +{
> > +	struct damon_probe *probe;
> > +	unsigned int sum = 0;
> > +	int i = 0;
> > +
> > +	damon_for_each_probe(probe, ctx) {
> > +		if (last)
> > +			sum += r->last_probe_hits[i++] * probe->weight;
> > +		else
> > +			sum += r->probe_hits[i++] * probe->weight;
> 
> [Severity: Medium]
> Can this calculation overflow the 32-bit unsigned integer?
> 
> Since sum and probe->weight are both typed as unsigned int, if a
> sufficiently large probe weight (for example, larger than 16,843,000) is
> configured via sysfs, this multiplication and accumulation might wrap around.
> 
> If the score wraps around to an artificially low value, would this cause
> DAMON's region merging logic to behave incorrectly due to unexpected
> thresholds?

It can overflow.  It doesn't make any critical cosnequences like kernel crash,
though.  Known low priority issue.

I'm considering avoiding this by adding the validation in the core layer
parameters validation, which is merged into mm-new today.


Thanks,
SJ

[...]