Re: [RFC PATCH 3/7] mm/damon/sysfs-schemes: support quota goal complement flag

[SJ Park <sj@kernel.org>]

On Fri, 18 Sep 2026 15:05:35 +0000 sashiko-bot@kernel.org wrote:

> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] mm: unsigned integer underflow in damos quota complement calculation
> --
> 
> commit 8f39260b8b618fca6e69e55388bee135a86971f3
> Author: SJ Park <sj@kernel.org>
> 
> mm/damon/sysfs-schemes: support quota goal complement flag
> 
> This commit adds a new sysfs file to support setting and getting the
> quota goal metric complement flag. It exposes this flag to user space,
> allowing the complement value to be passed to damos_new_quota_goal().
> 
> > diff --git a/mm/damon/sysfs-schemes.c b/mm/damon/sysfs-schemes.c
> > index 06af417bc9a2f..8f083611741fd 100644
> > --- a/mm/damon/sysfs-schemes.c
> > +++ b/mm/damon/sysfs-schemes.c
> [ ... ]
> > @@ -2869,7 +2898,8 @@ static int damos_sysfs_add_quota_score(
> >  		if (!sysfs_goal->target_value)
> >  			continue;
> >  
> > -		goal = damos_new_quota_goal(sysfs_goal->metric, false,
> > +		goal = damos_new_quota_goal(sysfs_goal->metric,
> > +				sysfs_goal->complement,
> >  				sysfs_goal->target_value);
> 
> [Severity: High]
> Does exposing the complement flag to user space introduce an integer
> underflow risk for PSI metrics?
> 
> When the complement flag is enabled via sysfs for a
> DAMOS_QUOTA_SOME_MEM_PSI_US goal, damos_set_quota_goal_current_value()
> in mm/damon/core.c performs a direct subtraction:
> 
> 	if (goal->metric == DAMOS_QUOTA_SOME_MEM_PSI_US)
> 		goal->current_value = s->quota.reset_interval * 1000 -
> 			goal->current_value;
> 	else
> 		goal->current_value = 10000 - goal->current_value;
> 
> Because DAMON runs in a preemptible worker thread, natural scheduling
> delays can cause the elapsed PSI time (initially stored in
> goal->current_value) to exceed the nominal reset_interval * 1000.
> 
> If this happens, the subtraction underflows, wrapping current_value to
> near ULONG_MAX. This corrupted value is then used to calculate the quota
> score, which completely breaks DAMON's throttling logic.

I will fix the core logic in the next revision.

> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20260918142827.85303-1-sj@kernel.org?part=3


Thanks,
SJ