Re: [RFC PATCH v2 7/7] Docs/ABI/damon: update for quota goal metric complement sysfs file

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] mm: integer underflow in damos_set_quota_goal_current_value()
--

commit f2de2d4493473c2c847f3ad213eaef640f0e1600
Author: SJ Park <sj@kernel.org>

mm/damon/core: introduce damos_quota_goal->complement

Introduce damos_quota_goal->complement for specifying whether to use a
complemented value of the given goal target metric. Add the field to
the data structure and implement essential core support.

> diff --git a/mm/damon/core.c b/mm/damon/core.c
> index 2258b72da7a78..9fd08cbfacd8c 100644
> --- a/mm/damon/core.c
> +++ b/mm/damon/core.c

[ ... ]

> @@ -3238,6 +3239,23 @@ static void damos_set_quota_goal_current_value(struct damon_ctx *c,
>  	default:
>  		break;
>  	}
> +	if (!goal->complement)
> +		return;
> +
> +	/* updte current_value to complemented value */
> +
> +	/* for user_input, users set complemented value on their own */
> +	if (goal->metric == DAMOS_QUOTA_USER_INPUT)
> +		return;
> +	if (goal->metric == DAMOS_QUOTA_SOME_MEM_PSI_US) {
> +		goal->current_value = s->quota.reset_interval * 1000 -
> +			goal->current_value;

[Severity: High]
Does this unprotected subtraction in damos_set_quota_goal_current_value() risk
an integer underflow?

If a user configures DAMOS_QUOTA_SOME_MEM_PSI_US with complement enabled via
sysfs and sets a target_value greater than reset_interval * 1000, the initial
round (where current_value = target_value) will immediately underflow.

Furthermore, if the kdamond thread is delayed by the scheduler beyond the reset
interval, the measured PSI time can naturally exceed reset_interval * 1000,
which would also trigger the underflow.

This underflow would result in a huge current_value (near ULONG_MAX), which is
then fed into damos_quota_score(), producing an astronomically high tuning
score that aggressively drops the effective quota to zero, breaking the quota
regulation mechanism.

> +		return;
> +	}
> +	if (goal->current_value < 10000)
> +		goal->current_value = 10000 - goal->current_value;
> +	else
> +		goal->current_value = 0;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260919011359.88921-1-sj@kernel.org?part=7