Re: [RFC PATCH v2 1/7] mm/damon/core: introduce damos_quota_goal->complement

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] mm: Integer underflow in DAMOS_QUOTA_SOME_MEM_PSI_US complement calculation
--

commit f2de2d4493473c2c847f3ad213eaef640f0e1600
Author: SJ Park <sj@kernel.org>

mm/damon/core: introduce damos_quota_goal->complement

Introduce damos_quota_goal->complement for specifying whether to use a
complemented value of the given goal target metric. Add the field to
the data structure and implement essential core support. Handle the
flag in the quota goal commit and current quota goal metric value
retrieval.

> diff --git a/mm/damon/core.c b/mm/damon/core.c
> index 2258b72da7a78..9fd08cbfacd8c 100644
> --- a/mm/damon/core.c
> +++ b/mm/damon/core.c
[ ... ]
> @@ -3238,6 +3239,23 @@ static void damos_set_quota_goal_current_value(struct damon_ctx *c,
>  	default:
>  		break;
>  	}
> +	if (!goal->complement)
> +		return;
> +
> +	/* updte current_value to complemented value */
> +
> +	/* for user_input, users set complemented value on their own */
> +	if (goal->metric == DAMOS_QUOTA_USER_INPUT)
> +		return;
> +	if (goal->metric == DAMOS_QUOTA_SOME_MEM_PSI_US) {
> +		goal->current_value = s->quota.reset_interval * 1000 -
> +			goal->current_value;

[Severity: High]
Does this unsigned subtraction underflow if goal->current_value exceeds
s->quota.reset_interval * 1000?

If goal->current_value exceeds the nominal reset interval, which can happen on
the first iteration when initialized to an arbitrarily large user-provided
target_value, or on subsequent iterations if kernel scheduling delays cause the
actual elapsed time between callbacks to exceed the nominal reset_interval,
this subtraction will underflow and produce a massive current_value near
ULONG_MAX.

This large value is then passed to damos_quota_score(), which computes a
normalized score that maxes out the feedback loop, forcing the tuned quota
limit to drop aggressively.

> +		return;
> +	}
> +	if (goal->current_value < 10000)
> +		goal->current_value = 10000 - goal->current_value;
> +	else
> +		goal->current_value = 0;
>  }
>  
>  /* Return the highest score since it makes schemes least aggressive */

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260919011359.88921-1-sj@kernel.org?part=1