Re: [PATCH 7/7] mm/damon/core: handle extreme memory state in get_in_active_mem_bp()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] 32-bit integer overflow in mult_frac() macro when calculating memory ratio on 32-bit systems, leading to completely incorrect DAMOS quota metrics.
--

commit b2f8512e8018294c2ac5082c2964a0519b9242e8
Author: SJ Park <sj@kernel.org>

mm/damon/core: handle extreme memory state in get_in_active_mem_bp()
    
damos_get_in_active_mem_bp() uses the sum of the active and inactive
memory amount as a denominator.  In an extreme and unlikely environment,
active and inactive memory might be zero.  In this case, hence, it
results in a divide by zero problem.  Avoid it by changing the
denominator to one if it is zero, before it is being used.

[1] https://lore.kernel.org/20260721034756.147011-1-sj@kernel.org

> diff --git a/mm/damon/core.c b/mm/damon/core.c
> index 6288bb3b09e65..fb96848174dcc 100644
> --- a/mm/damon/core.c
> +++ b/mm/damon/core.c
> @@ -3005,7 +3005,7 @@ static unsigned int damos_get_in_active_mem_bp(bool active_ratio)
>  		global_node_page_state(NR_LRU_BASE + LRU_ACTIVE_FILE);
>  	inactive = global_node_page_state(NR_LRU_BASE + LRU_INACTIVE_ANON) +
>  		global_node_page_state(NR_LRU_BASE + LRU_INACTIVE_FILE);
> -	total = active + inactive;
> +	total = max(active + inactive, 1);
>  	if (active_ratio)
>  		return mult_frac(active, 10000, total);

[Severity: High]
This is a pre-existing issue, but does this calculation overflow on
32-bit systems?

If the active memory size exceeds 429,496 pages (about 1.75 GB), multiplying
the 32-bit unsigned long active variable by 10,000 inside the mult_frac()
macro will overflow ULONG_MAX.

This can result in effectively random DAMON quota metrics on 32-bit systems,
leading DAMON to misinterpret memory states and potentially over-reclaim or
under-reclaim memory.

A similar overflow can also happen in damos_quota_score():

mm/damon/core.c:damos_quota_score() {
    ...
    return mult_frac(goal->current_value, 10000, goal->target_value);
}

Here, goal->current_value multiplied by 10,000 overflows for large values,
such as when microseconds of stall time exceed 430ms.

>  	return mult_frac(inactive, 10000, total);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260901131326.97615-1-sj@kernel.org?part=7