Re: [PATCH 6/7] mm/damon/core: handle extreme memory state in get_node_memcg_used_bp()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] 32-bit integer overflow in `mult_frac()` leads to wildly inaccurate quota calculations on architectures with 32-bit unsigned longs.
--

commit f507259fcccb65ad40eabec53de3e020582667f6
Author: SJ Park <sj@kernel.org>

mm/damon/core: handle extreme memory state in get_node_memcg_used_bp()

In extreme unlikely situations, total memory might be zero. In less
extreme but still very unlikely situations, lruvec_page_state() calls
might let the caller show used memory larger than total memory. In the
two cases, damos_get_node_memcg_used_bp() could cause division by zero,
or return underflowed value, respectively. Handle the cases by
respectively returning 100% and 0% for used and free memory queries in
the corner cases.

Link: https://lore.kernel.org/20260329154813.47382-1-sj@kernel.org

> diff --git a/mm/damon/core.c b/mm/damon/core.c
> index 32cde20de2792..6288bb3b09e65 100644
> --- a/mm/damon/core.c
> +++ b/mm/damon/core.c
> @@ -2853,6 +2853,12 @@ static unsigned long damos_get_node_memcg_used_bp(
>  	mem_cgroup_put(memcg);
>  
>  	si_meminfo_node(&i, goal->nid);
> +	if (!i.totalram || i.totalram < used_pages) {
> +		if (goal->metric == DAMOS_QUOTA_NODE_MEMCG_USED_BP)
> +			return 10000;
> +		else	/* DAMOS_QUOTA_NODE_MEMCG_FREE_BP */
> +			return 0;
> +	}
>  	if (goal->metric == DAMOS_QUOTA_NODE_MEMCG_USED_BP)
>  		numerator = used_pages;
>  	else	/* DAMOS_QUOTA_NODE_MEMCG_FREE_BP */
>  		numerator = i.totalram - used_pages;
>  	return mult_frac(numerator, 10000, i.totalram);

[Severity: High]
This is a pre-existing issue, but does this calculation overflow on 32-bit
architectures?

The mult_frac(numerator, 10000, i.totalram) macro computes
numerator * 10000 / i.totalram when the numerator is smaller than the
totalram. Because numerator is an unsigned long, this multiplication is
performed using 32-bit arithmetic on 32-bit architectures.

If the numerator exceeds roughly 429,496 pages (about 1.7 gigabytes of
memory), multiplying it by 10,000 exceeds the 32-bit integer maximum of
roughly 4.29 billion. This wraparound yields a massively inaccurate fraction.

This same overflow appears to also affect damos_get_node_mem_bp() and
damos_get_in_active_mem_bp().

Could numerator be cast to a 64-bit type before multiplication to prevent
this issue on larger memory systems with 32-bit kernels?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260901131326.97615-1-sj@kernel.org?part=6