Re: [PATCH 1/2] mm/damon/core-kunit: test probe_hits handling at region split and merge

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but there is an integer overflow in damon_merge_two_regions() when calculating size-weighted averages on 32-bit architectures.
--

--- Patch [1]: [PATCH 1/2] mm/damon/core-kunit: test probe_hits handling at region split and merge ---
commit f275f8ec2d833d0e2eacc7a18ba7c56b04b7e599
Author: Jason Angelov <jasonangelov@ucla.edu>

mm/damon/core-kunit: test probe_hits handling at region split and merge

Extend damon_test_split_at() and damon_test_merge_two() tests to cover
handling of probe_hits and last_probe_hits arrays.

> diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h
> index 4a536d41cdb2d..2db94d49c9bae 100644
> --- a/mm/damon/tests/core-kunit.h
> +++ b/mm/damon/tests/core-kunit.h
[ ... ]
> @@ -204,6 +210,7 @@ static void damon_test_merge_two(struct kunit *test)
>  	KUNIT_EXPECT_EQ(test, r->ar.start, 0ul);
>  	KUNIT_EXPECT_EQ(test, r->ar.end, 300ul);
>  	KUNIT_EXPECT_EQ(test, r->nr_accesses, 16u);
> +	KUNIT_EXPECT_EQ(test, r->probe_hits[0], 11);

[Severity: High]
This is a pre-existing issue, but does the size-weighted average logic
tested here overflow on 32-bit architectures?

Looking at mm/damon/core.c:damon_merge_two_regions(), the calculations
multiply values like nr_accesses and probe_hits by the region size in bytes:

mm/damon/core.c:damon_merge_two_regions() {
	...
	l->nr_accesses = (l->nr_accesses * sz_l + r->nr_accesses * sz_r) /
			(sz_l + sz_r);
	...
	for (i = 0; i < DAMON_MAX_PROBES; i++)
		l->probe_hits[i] = (l->probe_hits[i] * sz_l + r->probe_hits[i]
				* sz_r) / (sz_l + sz_r);
	...
}

On a 32-bit architecture, unsigned long is 32 bits (max ~4.29GB). If a
region is just 17MB and probe_hits is 255, the multiplication 
255 * 17,000,000 evaluates to ~4.33GB, which would silently truncate.

Could this wrap-around cause merged regions to inherit drastically incorrect
statistics, potentially misidentifying hot memory as cold and triggering
aggressive paging out of actively used pages?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260818034552.11975-1-jasonangelov@ucla.edu?part=1