mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: tip-bot for Andrey Ryabinin <tipbot@zytor.com>
To: linux-tip-commits@vger.kernel.org
Cc: aryabinin@virtuozzo.com, tglx@linutronix.de, mingo@kernel.org,
	torvalds@linux-foundation.org, linux-kernel@vger.kernel.org,
	hpa@zytor.com, peterz@infradead.org
Subject: [tip:sched/core] sched/fair: Fix multiplication overflow on 32-bit systems
Date: Wed, 6 Jan 2016 10:47:30 -0800	[thread overview]
Message-ID: <tip-9e0e83a1eca66f8369e5a02973f85aad65c32416@git.kernel.org> (raw)
In-Reply-To: <1450097243-30137-1-git-send-email-aryabinin@virtuozzo.com>

Commit-ID:  9e0e83a1eca66f8369e5a02973f85aad65c32416
Gitweb:     http://git.kernel.org/tip/9e0e83a1eca66f8369e5a02973f85aad65c32416
Author:     Andrey Ryabinin <aryabinin@virtuozzo.com>
AuthorDate: Mon, 14 Dec 2015 15:47:23 +0300
Committer:  Ingo Molnar <mingo@kernel.org>
CommitDate: Wed, 6 Jan 2016 11:01:05 +0100

sched/fair: Fix multiplication overflow on 32-bit systems

Make 'r' 64-bit type to avoid overflow in 'r * LOAD_AVG_MAX'
on 32-bit systems:

	UBSAN: Undefined behaviour in kernel/sched/fair.c:2785:18
	signed integer overflow:
	87950 * 47742 cannot be represented in type 'int'

The most likely effect of this bug are bad load average numbers
resulting in weird scheduling. It's also likely that this can
persist for a longer time - until the system goes idle for
a long time so that all load avg numbers get reset.

[ This is the CFS load average metric, not the procfs output, which
  is separate. ]

Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: 9d89c257dfb9 ("sched/fair: Rewrite runnable load and utilization average tracking")
Link: http://lkml.kernel.org/r/1450097243-30137-1-git-send-email-aryabinin@virtuozzo.com
[ Improved the changelog. ]
Signed-off-by: Ingo Molnar <mingo@kernel.org>
---
 kernel/sched/fair.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 90e26b1..cfdc0e6 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -2689,7 +2689,7 @@ static inline int update_cfs_rq_load_avg(u64 now, struct cfs_rq *cfs_rq)
 	int decayed, removed = 0;
 
 	if (atomic_long_read(&cfs_rq->removed_load_avg)) {
-		long r = atomic_long_xchg(&cfs_rq->removed_load_avg, 0);
+		s64 r = atomic_long_xchg(&cfs_rq->removed_load_avg, 0);
 		sa->load_avg = max_t(long, sa->load_avg - r, 0);
 		sa->load_sum = max_t(s64, sa->load_sum - r * LOAD_AVG_MAX, 0);
 		removed = 1;

      parent reply	other threads:[~2016-01-06 18:48 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-12-14 12:47 [PATCH v2] sched/fair: fix mul " Andrey Ryabinin
2015-12-14 14:35 ` Peter Zijlstra
2016-01-06 18:47 ` tip-bot for Andrey Ryabinin [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=tip-9e0e83a1eca66f8369e5a02973f85aad65c32416@git.kernel.org \
    --to=tipbot@zytor.com \
    --cc=aryabinin@virtuozzo.com \
    --cc=hpa@zytor.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-tip-commits@vger.kernel.org \
    --cc=mingo@kernel.org \
    --cc=peterz@infradead.org \
    --cc=tglx@linutronix.de \
    --cc=torvalds@linux-foundation.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

Powered by JetHome