Re: [RFC PATCH v2 7/7] Docs/ABI/damon: update for quota goal metric complement sysfs file

[SJ Park <sj@kernel.org>]

On Sat, 19 Sep 2026 01:23:21 +0000 sashiko-bot@kernel.org wrote:

> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] mm: integer underflow in damos_set_quota_goal_current_value()
> --
> 
> commit f2de2d4493473c2c847f3ad213eaef640f0e1600
> Author: SJ Park <sj@kernel.org>
> 
> mm/damon/core: introduce damos_quota_goal->complement
> 
> Introduce damos_quota_goal->complement for specifying whether to use a
> complemented value of the given goal target metric. Add the field to
> the data structure and implement essential core support.
> 
> > diff --git a/mm/damon/core.c b/mm/damon/core.c
> > index 2258b72da7a78..9fd08cbfacd8c 100644
> > --- a/mm/damon/core.c
> > +++ b/mm/damon/core.c
> 
> [ ... ]
> 
> > @@ -3238,6 +3239,23 @@ static void damos_set_quota_goal_current_value(struct damon_ctx *c,
> >  	default:
> >  		break;
> >  	}
> > +	if (!goal->complement)
> > +		return;
> > +
> > +	/* updte current_value to complemented value */
> > +
> > +	/* for user_input, users set complemented value on their own */
> > +	if (goal->metric = DAMOS_QUOTA_USER_INPUT)
> > +		return;
> > +	if (goal->metric = DAMOS_QUOTA_SOME_MEM_PSI_US) {
> > +		goal->current_value = s->quota.reset_interval * 1000 -
> > +			goal->current_value;
> 
> [Severity: High]
> Does this unprotected subtraction in damos_set_quota_goal_current_value() risk
> an integer underflow?
> 
> If a user configures DAMOS_QUOTA_SOME_MEM_PSI_US with complement enabled via
> sysfs and sets a target_value greater than reset_interval * 1000, the initial
> round (where current_value = target_value) will immediately underflow.
> 
> Furthermore, if the kdamond thread is delayed by the scheduler beyond the reset
> interval, the measured PSI time can naturally exceed reset_interval * 1000,
> which would also trigger the underflow.
> 
> This underflow would result in a huge current_value (near ULONG_MAX), which is
> then fed into damos_quota_score(), producing an astronomically high tuning
> score that aggressively drops the effective quota to zero, breaking the quota
> regulation mechanism.

I will fix this in the next spin.

> 
> > +		return;
> > +	}
> > +	if (goal->current_value < 10000)
> > +		goal->current_value = 10000 - goal->current_value;
> > +	else
> > +		goal->current_value = 0;
> >  }
> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20260919011359.88921-1-sj@kernel.org?part=7
> 


Thanks,
SJ