linux-kernel - Re: [PATCH] sched: Fix out-of-bound access in uclamp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <YIrKos+40mQnqFMR@google.com>
Date:   Thu, 29 Apr 2021 15:02:58 +0000
From:   Quentin Perret <qperret@...gle.com>
To:     Dietmar Eggemann <dietmar.eggemann@....com>
Cc:     mingo@...hat.com, peterz@...radead.org, vincent.guittot@...aro.org,
        juri.lelli@...hat.com, rostedt@...dmis.org, bsegall@...gle.com,
        mgorman@...e.de, bristot@...hat.com, qais.yousef@....com,
        kernel-team@...roid.com, linux-kernel@...r.kernel.org,
        patrick.bellasi@...bug.net
Subject: Re: [PATCH] sched: Fix out-of-bound access in uclamp

On Thursday 29 Apr 2021 at 14:34:14 (+0200), Dietmar Eggemann wrote:
> On 28/04/2021 19:27, Quentin Perret wrote:
> > Util-clamp places tasks in different buckets based on their clamp values
> > for performance reasons. However, the size of buckets is currently
> > computed using a rounding division, which can lead to an off-by-one
> > error in some configurations.
> > 
> > For instance, with 20 buckets, the bucket size will be 1024/20=51.2,
> > rounded to the closest value: 51. Now, a task with a clamp of 1024 (as
> > is the default for the min clamp of RT tasks) will be mapped to bucket
> > id 1024/51=20 as we're now using a standard integer division. Sadly,
> > correct indexes are in range [0,19], hence leading to an out of bound
> > memory access.
> > 
> > Fix this by using a rounding-up division when computing the bucket size.
> 
> But in case you use e.g. 16 buckets, wouldn't you still end up with this
> task mapped into bucket_id=16?
> 
> 1024/16=64
> 
> 1024/64=16

Hrmpf, you're right ...

So I guess the following will do:

    #define UCLAMP_BUCKET_DELTA (SCHED_CAPACITY_SCALE / UCLAMP_BUCKETS + 1)

Thanks,
Quentin