Re: [RFC PATCH 1/7] mm/damon/core: introduce damos_quota_goal->complement

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] mm: integer underflow in damos_set_quota_goal_current_value() for complemented metrics
--

commit 94b0fa41235165f1d082ca5735dcefbf9f65199b
Author: SJ Park <sj@kernel.org>

mm/damon/core: introduce damos_quota_goal->complement

This commit introduces the complement field to struct damos_quota_goal
to allow specifying whether to use a complemented value of the goal target
metric. It adds the field and implements the core support, handling the flag
during quota goal commit and current quota goal metric value retrieval.

> diff --git a/mm/damon/core.c b/mm/damon/core.c
> index 2258b72da7a78..25a8221dd2a40 100644
> --- a/mm/damon/core.c
> +++ b/mm/damon/core.c

[ ... ]

> @@ -3238,6 +3239,19 @@ static void damos_set_quota_goal_current_value(struct damon_ctx *c,
>  	default:
>  		break;
>  	}
> +	if (!goal->complement)
> +		return;
> +
> +	/* updte current_value to complemented value */
> +
> +	/* for user_input, users set complemented value on their own */
> +	if (goal->metric == DAMOS_QUOTA_USER_INPUT)
> +		return;
> +	if (goal->metric == DAMOS_QUOTA_SOME_MEM_PSI_US)
> +		goal->current_value = s->quota.reset_interval * 1000 -
> +			goal->current_value;
> +	else
> +		goal->current_value = 10000 - goal->current_value;

[Severity: High]
Can this unsigned subtraction result in an integer underflow?

In damos_set_quota_goal_current_value(), if the measured memory stall
(current_value) exceeds the reset interval due to kdamond thread
scheduling delays, heavy system load, or if the user configures
reset_interval_ms to 0 via sysfs, s->quota.reset_interval * 1000 -
goal->current_value will underflow.

Similarly, for BP metrics relying on loosely-coupled lockless kernel counters
(e.g., global_node_page_state), per-CPU drift can occasionally cause the
returned value to exceed 10000, causing 10000 - goal->current_value to
underflow.

If an underflow occurs, it produces a value near ULONG_MAX.

Would passing this immense value to the auto-tuner mistakenly drop the scheme's
reclaim quota to its minimum precisely when memory pressure is highest?

>  }
>  
>  /* Return the highest score since it makes schemes least aggressive */

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260918142827.85303-1-sj@kernel.org?part=1