Re: [RFC PATCH v2 3/7] mm/damon/sysfs-schemes: support quota goal complement flag

[SJ Park <sj@kernel.org>]

On Sat, 19 Sep 2026 01:26:35 +0000 sashiko-bot@kernel.org wrote:

> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] mm/damon: integer underflow in DAMOS_QUOTA_SOME_MEM_PSI_US complement calculation
> --
> 
> commit cd02e1bd14a7884bf9a21f0cab584b1a0f9992ce
> Author: SJ Park <sj@kernel.org>
> 
> mm/damon/sysfs-schemes: support quota goal complement flag
> 
> This patch adds a new sysfs file for the quota goal directory to allow
> setting and getting the quota goal metric complement flag value.
> 
> > diff --git a/mm/damon/sysfs-schemes.c b/mm/damon/sysfs-schemes.c
> > index 06af417bc9a2f..8f083611741fd 100644
> > --- a/mm/damon/sysfs-schemes.c
> > +++ b/mm/damon/sysfs-schemes.c
> 
> [ ... ]
> 
> > @@ -2869,7 +2898,8 @@ static int damos_sysfs_add_quota_score(
> >  		if (!sysfs_goal->target_value)
> >  			continue;
> >  
> > -		goal = damos_new_quota_goal(sysfs_goal->metric, false,
> > +		goal = damos_new_quota_goal(sysfs_goal->metric,
> > +				sysfs_goal->complement,
> >  				sysfs_goal->target_value);
> >  		if (!goal)
> >  			return -ENOMEM;
> 
> [Severity: High]
> Now that complement = true can be configured via sysfs, does this expose
> an integer underflow in damos_set_quota_goal_current_value()?
> 
> If a user configures a DAMOS quota goal using DAMOS_QUOTA_SOME_MEM_PSI_US
> with complement = true, the actual elapsed wall-clock time between
> evaluations can exceed the configured s->quota.reset_interval due to
> routine thread scheduling delays or high system load.
> 
> In mm/damon/core.c:damos_set_quota_goal_current_value(), the accumulated
> PSI time (goal->current_value) could then exceed reset_interval * 1000,
> underflowing the unsigned subtraction:
> 
> 	if (goal->metric = DAMOS_QUOTA_SOME_MEM_PSI_US) {
> 		goal->current_value = s->quota.reset_interval * 1000 -
> 			goal->current_value;
> 		return;
> 	}
> 
> Unlike the basis-point metrics below it, this lacks a safety bounds check.
> The unsigned integer underflow results in an erroneously massive quota score.
> 
> This causes damon_feed_loop_next_input() to evaluate score >= goal * 2 and
> return the minimum possible input (min_input), severely throttling the quota
> size (esz) to a minimal value.
> 
> This effectively disables DAMOS scheme actions for that window, despite the
> system being under severe memory pressure, which is exactly when tuning
> is most important.

I will fix in the next revision.

> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20260919011359.88921-1-sj@kernel.org?part=3
> 


Thanks,
SJ