From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.2 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,NICE_REPLY_A,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 529E4C433ED for ; Mon, 3 May 2021 10:55:49 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 170B0611C2 for ; Mon, 3 May 2021 10:55:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233475AbhECK4k (ORCPT ); Mon, 3 May 2021 06:56:40 -0400 Received: from foss.arm.com ([217.140.110.172]:39370 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233259AbhECK4j (ORCPT ); Mon, 3 May 2021 06:56:39 -0400 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 74063ED1; Mon, 3 May 2021 03:55:45 -0700 (PDT) Received: from [192.168.178.6] (unknown [172.31.20.19]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 2B9463F718; Mon, 3 May 2021 03:55:43 -0700 (PDT) Subject: Re: [PATCH v3] sched: Fix out-of-bound access in uclamp To: Vincent Guittot , Quentin Perret Cc: Ingo Molnar , Peter Zijlstra , Juri Lelli , Steven Rostedt , Ben Segall , Mel Gorman , Daniel Bristot de Oliveira , Qais Yousef , Android Kernel Team , linux-kernel , Patrick Bellasi References: <20210430151412.160913-1-qperret@google.com> From: Dietmar Eggemann Message-ID: <562004ff-9f60-bf37-df4c-547415ae2cd5@arm.com> Date: Mon, 3 May 2021 12:55:34 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.7.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 30/04/2021 17:27, Vincent Guittot wrote: > On Fri, 30 Apr 2021 at 17:14, Quentin Perret wrote: >> >> Util-clamp places tasks in different buckets based on their clamp values >> for performance reasons. However, the size of buckets is currently >> computed using a rounding division, which can lead to an off-by-one >> error in some configurations. >> >> For instance, with 20 buckets, the bucket size will be 1024/20=51. A >> task with a clamp of 1024 will be mapped to bucket id 1024/51=20. Sadly, >> correct indexes are in range [0,19], hence leading to an out of bound >> memory access. >> >> Clamp the bucket id to fix the issue. >> >> Fixes: 69842cba9ace ("sched/uclamp: Add CPU's clamp buckets refcounting") >> Suggested-by: Qais Yousef >> Signed-off-by: Quentin Perret > > Reviewed-by: Vincent Guittot I forgot that config UCLAMP_BUCKETS_COUNT is in range 5 ... 20. So the error is bound to [-2 ... 5] (13/79, 20/51). I agree that we can live with that. Reviewed-by: Dietmar Eggemann >> --- >> Changes in v3: >> - Keep rounding div to improve fairness (Vincent) >> --- >> kernel/sched/core.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/kernel/sched/core.c b/kernel/sched/core.c >> index 98191218d891..c12ec648423e 100644 >> --- a/kernel/sched/core.c >> +++ b/kernel/sched/core.c >> @@ -928,7 +928,7 @@ DEFINE_STATIC_KEY_FALSE(sched_uclamp_used); >> >> static inline unsigned int uclamp_bucket_id(unsigned int clamp_value) >> { >> - return clamp_value / UCLAMP_BUCKET_DELTA; >> + return min_t(unsigned int, clamp_value / UCLAMP_BUCKET_DELTA, UCLAMP_BUCKETS - 1); >> } >> >> static inline unsigned int uclamp_none(enum uclamp_id clamp_id) >> -- >> 2.31.1.527.g47e6f16901-goog >>