Re: [RFC PATCH v2 3/7] mm/damon/sysfs-schemes: support quota goal complement flag

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] mm/damon: integer underflow in DAMOS_QUOTA_SOME_MEM_PSI_US complement calculation
--

commit cd02e1bd14a7884bf9a21f0cab584b1a0f9992ce
Author: SJ Park <sj@kernel.org>

mm/damon/sysfs-schemes: support quota goal complement flag

This patch adds a new sysfs file for the quota goal directory to allow
setting and getting the quota goal metric complement flag value.

> diff --git a/mm/damon/sysfs-schemes.c b/mm/damon/sysfs-schemes.c
> index 06af417bc9a2f..8f083611741fd 100644
> --- a/mm/damon/sysfs-schemes.c
> +++ b/mm/damon/sysfs-schemes.c

[ ... ]

> @@ -2869,7 +2898,8 @@ static int damos_sysfs_add_quota_score(
>  		if (!sysfs_goal->target_value)
>  			continue;
>  
> -		goal = damos_new_quota_goal(sysfs_goal->metric, false,
> +		goal = damos_new_quota_goal(sysfs_goal->metric,
> +				sysfs_goal->complement,
>  				sysfs_goal->target_value);
>  		if (!goal)
>  			return -ENOMEM;

[Severity: High]
Now that complement = true can be configured via sysfs, does this expose
an integer underflow in damos_set_quota_goal_current_value()?

If a user configures a DAMOS quota goal using DAMOS_QUOTA_SOME_MEM_PSI_US
with complement = true, the actual elapsed wall-clock time between
evaluations can exceed the configured s->quota.reset_interval due to
routine thread scheduling delays or high system load.

In mm/damon/core.c:damos_set_quota_goal_current_value(), the accumulated
PSI time (goal->current_value) could then exceed reset_interval * 1000,
underflowing the unsigned subtraction:

	if (goal->metric == DAMOS_QUOTA_SOME_MEM_PSI_US) {
		goal->current_value = s->quota.reset_interval * 1000 -
			goal->current_value;
		return;
	}

Unlike the basis-point metrics below it, this lacks a safety bounds check.
The unsigned integer underflow results in an erroneously massive quota score.

This causes damon_feed_loop_next_input() to evaluate score >= goal * 2 and
return the minimum possible input (min_input), severely throttling the quota
size (esz) to a minimal value.

This effectively disables DAMOS scheme actions for that window, despite the
system being under severe memory pressure, which is exactly when tuning
is most important.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260919011359.88921-1-sj@kernel.org?part=3