[v2] sched/fair: Fix integer underflow

[PATCH v2] sched/fair: Fix integer underflow

Posted by Pierre Gondois 1 year, 4 months ago

(struct sg_lb_stats).idle_cpus is of type 'unsigned int'.
(local->idle_cpus - busiest->idle_cpus) can underflow to UINT_MAX
for instance, and max_t(long, 0, UINT_MAX) will output UINT_MAX.

Use lsub_positive() instead of max_t().

Fixes: 16b0a7a1a0af ("sched/fair: Ensure tasks spreading in LLC during LB")
cc: stable@vger.kernel.org
Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
---
 kernel/sched/fair.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 9057584ec06d..6d9124499f52 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -10775,8 +10775,8 @@ static inline void calculate_imbalance(struct lb_env *env, struct sd_lb_stats *s
 			 * idle CPUs.
 			 */
 			env->migration_type = migrate_task;
-			env->imbalance = max_t(long, 0,
-					       (local->idle_cpus - busiest->idle_cpus));
+			env->imbalance = local->idle_cpus;
+			lsub_positive(&env->imbalance, busiest->idle_cpus);
 		}
 
 #ifdef CONFIG_NUMA
-- 
2.25.1

Re: [PATCH v2] sched/fair: Fix integer underflow

Posted by Pierre Gondois 10 months, 2 weeks ago

Hello Vincent,

This patch should still be relevant, would it be possible to pick it ?
Or maybe something is missing ?

Regards,
Pierre

On 10/1/24 15:46, Pierre Gondois wrote:
> (struct sg_lb_stats).idle_cpus is of type 'unsigned int'.
> (local->idle_cpus - busiest->idle_cpus) can underflow to UINT_MAX
> for instance, and max_t(long, 0, UINT_MAX) will output UINT_MAX.
> 
> Use lsub_positive() instead of max_t().
> 
> Fixes: 16b0a7a1a0af ("sched/fair: Ensure tasks spreading in LLC during LB")
> cc: stable@vger.kernel.org
> Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
> Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
> ---
>   kernel/sched/fair.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
> index 9057584ec06d..6d9124499f52 100644
> --- a/kernel/sched/fair.c
> +++ b/kernel/sched/fair.c
> @@ -10775,8 +10775,8 @@ static inline void calculate_imbalance(struct lb_env *env, struct sd_lb_stats *s
>   			 * idle CPUs.
>   			 */
>   			env->migration_type = migrate_task;
> -			env->imbalance = max_t(long, 0,
> -					       (local->idle_cpus - busiest->idle_cpus));
> +			env->imbalance = local->idle_cpus;
> +			lsub_positive(&env->imbalance, busiest->idle_cpus);
>   		}
>   
>   #ifdef CONFIG_NUMA

Re: [PATCH v2] sched/fair: Fix integer underflow

Posted by Vincent Guittot 10 months, 2 weeks ago

Hi Pierre,

On Tue, 25 Mar 2025 at 16:10, Pierre Gondois <pierre.gondois@arm.com> wrote:
>
> Hello Vincent,
>
> This patch should still be relevant, would it be possible to pick it ?
> Or maybe something is missing ?

Nothing is missing, the patch just got lost somewhere.

Ingo, Peter,
Could we take it once rc1 is published ?

Regards,
Vincent

>
> Regards,
> Pierre
>
> On 10/1/24 15:46, Pierre Gondois wrote:
> > (struct sg_lb_stats).idle_cpus is of type 'unsigned int'.
> > (local->idle_cpus - busiest->idle_cpus) can underflow to UINT_MAX
> > for instance, and max_t(long, 0, UINT_MAX) will output UINT_MAX.
> >
> > Use lsub_positive() instead of max_t().
> >
> > Fixes: 16b0a7a1a0af ("sched/fair: Ensure tasks spreading in LLC during LB")
> > cc: stable@vger.kernel.org
> > Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
> > Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
> > ---
> >   kernel/sched/fair.c | 4 ++--
> >   1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
> > index 9057584ec06d..6d9124499f52 100644
> > --- a/kernel/sched/fair.c
> > +++ b/kernel/sched/fair.c
> > @@ -10775,8 +10775,8 @@ static inline void calculate_imbalance(struct lb_env *env, struct sd_lb_stats *s
> >                        * idle CPUs.
> >                        */
> >                       env->migration_type = migrate_task;
> > -                     env->imbalance = max_t(long, 0,
> > -                                            (local->idle_cpus - busiest->idle_cpus));
> > +                     env->imbalance = local->idle_cpus;
> > +                     lsub_positive(&env->imbalance, busiest->idle_cpus);
> >               }
> >
> >   #ifdef CONFIG_NUMA