Re: [PATCH v2 14/23] mm: allow specifying custom oom constraint for BPF triggers

[Chris Mason <clm@meta.com>]

On 10/27/25 7:48 PM, bot+bpf-ci@kernel.org wrote:
>> @@ -1350,11 +1367,14 @@ __bpf_kfunc int bpf_oom_kill_process(struct oom_control *oc,
>>   * Returns a negative value if an error occurred.
>>   */
>>  __bpf_kfunc int bpf_out_of_memory(struct mem_cgroup *memcg__nullable,
>> -				  int order, u64 flags)
>> +				  int order, u64 flags,
>> +				  const char *constraint_text__nullable)
>>  {
>>  	struct oom_control oc = {
>>  		.memcg = memcg__nullable,
>>  		.order = order,
>> +		.constraint = CONSTRAINT_BPF,
>> +		.bpf_constraint = constraint_text__nullable,
>>  	};
>>  	int ret;
> 
> When CONSTRAINT_BPF is set in bpf_out_of_memory(), the early return in
> constrained_alloc() prevents oc->totalpages from being initialized.  This
> leaves totalpages at zero (from the designated initializer).
> 
> Later in the call chain out_of_memory()->select_bad_process()->
> oom_evaluate_task()->oom_badness(), the code performs division by
> totalpages at line 237:
> 
>     adj *= totalpages / 1000;
> 
> Can this cause a division by zero?  The path is reachable when a BPF
> program calls bpf_out_of_memory() and either no BPF OOM handler is
> registered or the handler fails to free memory, causing execution to fall
> through to select_bad_process().

Looks like the AI got a little excited about finding the uninit variable
chain and forgot what dividing by zero really means.  I'll add a false
positive check for this.

-chris