Re: [RFC PATCH 2/6] mm/damon/core: s/accesses_bp_to_nr_accesses/sample_bp_to_count/

[SJ Park <sj@kernel.org>]

On Tue, 07 Jul 2026 04:49:06 +0000 sashiko-bot@kernel.org wrote:

> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> 
> Pre-existing issues:
> - [High] 32-bit integer overflow in conversions between basis points (bp) and sample counts due to large number of samples per aggregation interval.
> --
> 
> --- Patch [2]: [RFC PATCH 2/6] mm/damon/core: s/accesses_bp_to_nr_accesses/sample_bp_to_count/ ---
> commit 26f76c0115cf94c7177c6588b38ff64dabf63ab2
> Author: SJ Park <sj@kernel.org>
> 
> mm/damon/core: s/accesses_bp_to_nr_accesses/sample_bp_to_count/
> 
> This commit renames accesses_bp_to_nr_accesses() to
> damon_sample_bp_to_count() to better reflect that it converts a samples ratio
> (in basis points) to a count. It also updates the callsites and comments to
> match the new name.
> 
> > diff --git a/mm/damon/core.c b/mm/damon/core.c
> > index e710e2789085e..ca530faaa4f83 100644
> > --- a/mm/damon/core.c
> > +++ b/mm/damon/core.c
> > @@ -876,11 +876,11 @@ static unsigned int damon_age_for_new_attrs(unsigned int age,
> >  	return age * old_attrs->aggr_interval / new_attrs->aggr_interval;
> >  }
> >  
> > -/* convert access ratio in bp (per 10,000) to nr_accesses */
> > -static unsigned int damon_accesses_bp_to_nr_accesses(
> > -		unsigned int accesses_bp, struct damon_attrs *attrs)
> > +/* convert sample ratio in bp (per 10,000) to count */
> > +static unsigned int damon_sample_bp_to_count(
> > +		unsigned int bp, struct damon_attrs *attrs)
> >  {
> > -	return accesses_bp * damon_nr_samples_per_aggr(attrs) / 10000;
> > +	return bp * damon_nr_samples_per_aggr(attrs) / 10000;
> 
> [Severity: High]
> This isn't a bug introduced by this patch, but can the product of bp and
> damon_nr_samples_per_aggr() overflow 32 bits?
> 
> Since both bp and the return value of damon_nr_samples_per_aggr() are 32-bit
> unsigned integers, their product can exceed 32 bits if the number of samples
> per aggregation interval is large (greater than ~429,496).
> 
> For example, a 1ms sample interval and a 10-minute aggregation interval would
> result in 600,000 samples. If bp is 10,000 (100%), the multiplication
> 10,000 * 600,000 overflows 32 bits to 1,705,032,704, resulting in a truncated
> count of 170,503 instead of 600,000.
> 
> A similar overflow can occur in damon_nr_accesses_to_accesses_bp() when
> evaluating (nr_accesses % nr_samples) * 10000 inside mult_frac() for large
> nr_accesses values, falsely marking hot memory as cold.

Known low priority issue.

> 
> >  }
> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20260707043828.97900-1-sj@kernel.org?part=2


Thanks,
SJ

[...]