Re: [RFC PATCH v1.2 3/7] mm/damon/core: s/accesses_bp_to_nr_accesses/sample_bp_to_count/

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The calculation of sample counts and ratios in `damon_sample_bp_to_count()` and `damon_nr_accesses_to_accesses_bp()` can suffer from a 32-bit integer overflow under extreme interval configurations, leading to corrupted DAMON metrics.
--

--- Patch [3]: [RFC PATCH v1.2 3/7] mm/damon/core: s/accesses_bp_to_nr_accesses/sample_bp_to_count/ ---
commit e8ec17a3e305676513352140eeb31c1b75063618
Author: SJ Park <sj@kernel.org>

mm/damon/core: s/accesses_bp_to_nr_accesses/sample_bp_to_count/

This commit renames accesses_bp_to_nr_accesses() to sample_bp_to_count() 
to better describe its actual behavior. The function converts a positive 
samples ratio into a count.

> diff --git a/mm/damon/core.c b/mm/damon/core.c
> --- a/mm/damon/core.c
> +++ b/mm/damon/core.c
> @@ -876,11 +876,11 @@ static unsigned int damon_age_for_new_attrs(unsigned int age,
>  	return age * old_attrs->aggr_interval / new_attrs->aggr_interval;
>  }
>  
> -/* convert access ratio in bp (per 10,000) to nr_accesses */
> -static unsigned int damon_accesses_bp_to_nr_accesses(
> -		unsigned int accesses_bp, struct damon_attrs *attrs)
> +/* convert sample ratio in bp (per 10,000) to count */
> +static unsigned int damon_sample_bp_to_count(
> +		unsigned int bp, struct damon_attrs *attrs)
>  {
> -	return accesses_bp * damon_nr_samples_per_aggr(attrs) / 10000;
> +	return bp * damon_nr_samples_per_aggr(attrs) / 10000;
[Severity: High]
This is a pre-existing issue, but can the 32-bit unsigned arithmetic here
silently overflow under extreme configurations?

If an automated tool configures DAMON via sysfs (for example, with
sample_us = 1 and aggr_us = 1000000) such that the ratio
aggr_interval / sample_interval exceeds 429,496, the multiplication
bp * damon_nr_samples_per_aggr(attrs) would exceed 32 bits.

This could return a heavily truncated count, potentially corrupting access
metrics and causing flawed memory management decisions.

A similar overflow appears to happen in the calculation of the ratio in
damon_nr_accesses_to_accesses_bp(). When it calls mult_frac, the parameter
nr_accesses is an unsigned int, causing nr_accesses * 10000 to overflow
and wrap around when evaluating the remainder multiplication.

>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260708013252.95888-1-sj@kernel.org?part=3