Re: [RFC PATCH 1/7] mm/damon/core: introduce damos_quota_goal->complement

[SJ Park <sj@kernel.org>]

On Fri, 18 Sep 2026 14:48:17 +0000 sashiko-bot@kernel.org wrote:

> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] mm: integer underflow in damos_set_quota_goal_current_value() for complemented metrics
> --
> 
> commit 94b0fa41235165f1d082ca5735dcefbf9f65199b
> Author: SJ Park <sj@kernel.org>
> 
> mm/damon/core: introduce damos_quota_goal->complement
> 
> This commit introduces the complement field to struct damos_quota_goal
> to allow specifying whether to use a complemented value of the goal target
> metric. It adds the field and implements the core support, handling the flag
> during quota goal commit and current quota goal metric value retrieval.
> 
> > diff --git a/mm/damon/core.c b/mm/damon/core.c
> > index 2258b72da7a78..25a8221dd2a40 100644
> > --- a/mm/damon/core.c
> > +++ b/mm/damon/core.c
> 
> [ ... ]
> 
> > @@ -3238,6 +3239,19 @@ static void damos_set_quota_goal_current_value(struct damon_ctx *c,
> >  	default:
> >  		break;
> >  	}
> > +	if (!goal->complement)
> > +		return;
> > +
> > +	/* updte current_value to complemented value */
> > +
> > +	/* for user_input, users set complemented value on their own */
> > +	if (goal->metric == DAMOS_QUOTA_USER_INPUT)
> > +		return;
> > +	if (goal->metric == DAMOS_QUOTA_SOME_MEM_PSI_US)
> > +		goal->current_value = s->quota.reset_interval * 1000 -
> > +			goal->current_value;
> > +	else
> > +		goal->current_value = 10000 - goal->current_value;
> 
> [Severity: High]
> Can this unsigned subtraction result in an integer underflow?
> 
> In damos_set_quota_goal_current_value(), if the measured memory stall
> (current_value) exceeds the reset interval due to kdamond thread
> scheduling delays, heavy system load, or if the user configures
> reset_interval_ms to 0 via sysfs, s->quota.reset_interval * 1000 -
> goal->current_value will underflow.
> 
> Similarly, for BP metrics relying on loosely-coupled lockless kernel counters
> (e.g., global_node_page_state), per-CPU drift can occasionally cause the
> returned value to exceed 10000, causing 10000 - goal->current_value to
> underflow.
> 
> If an underflow occurs, it produces a value near ULONG_MAX.
> 
> Would passing this immense value to the auto-tuner mistakenly drop the scheme's
> reclaim quota to its minimum precisely when memory pressure is highest?

Good catch.  I will fix this in the next revision.

> 
> >  }
> >  
> >  /* Return the highest score since it makes schemes least aggressive */
> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20260918142827.85303-1-sj@kernel.org?part=1


Thanks,
SJ