Re: [RFC PATCH 3/7] mm/damon/sysfs-schemes: support quota goal complement flag

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] mm: unsigned integer underflow in damos quota complement calculation
--

commit 8f39260b8b618fca6e69e55388bee135a86971f3
Author: SJ Park <sj@kernel.org>

mm/damon/sysfs-schemes: support quota goal complement flag

This commit adds a new sysfs file to support setting and getting the
quota goal metric complement flag. It exposes this flag to user space,
allowing the complement value to be passed to damos_new_quota_goal().

> diff --git a/mm/damon/sysfs-schemes.c b/mm/damon/sysfs-schemes.c
> index 06af417bc9a2f..8f083611741fd 100644
> --- a/mm/damon/sysfs-schemes.c
> +++ b/mm/damon/sysfs-schemes.c
[ ... ]
> @@ -2869,7 +2898,8 @@ static int damos_sysfs_add_quota_score(
>  		if (!sysfs_goal->target_value)
>  			continue;
>  
> -		goal = damos_new_quota_goal(sysfs_goal->metric, false,
> +		goal = damos_new_quota_goal(sysfs_goal->metric,
> +				sysfs_goal->complement,
>  				sysfs_goal->target_value);

[Severity: High]
Does exposing the complement flag to user space introduce an integer
underflow risk for PSI metrics?

When the complement flag is enabled via sysfs for a
DAMOS_QUOTA_SOME_MEM_PSI_US goal, damos_set_quota_goal_current_value()
in mm/damon/core.c performs a direct subtraction:

	if (goal->metric == DAMOS_QUOTA_SOME_MEM_PSI_US)
		goal->current_value = s->quota.reset_interval * 1000 -
			goal->current_value;
	else
		goal->current_value = 10000 - goal->current_value;

Because DAMON runs in a preemptible worker thread, natural scheduling
delays can cause the elapsed PSI time (initially stored in
goal->current_value) to exceed the nominal reset_interval * 1000.

If this happens, the subtraction underflows, wrapping current_value to
near ULONG_MAX. This corrupted value is then used to calculate the quota
score, which completely breaks DAMON's throttling logic.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260918142827.85303-1-sj@kernel.org?part=3