Re: [PATCH] sched/fair: Fix shift-out-of-bounds in load_balance()

[Peter Zijlstra]

On Thu, Feb 25, 2021 at 05:56:56PM +0000, Valentin Schneider wrote:
> Syzbot reported a handful of occurrences where an sd->nr_balance_failed can
> grow to much higher values than one would expect.
> 
> A successful load_balance() resets it to 0; a failed one increments
> it. Once it gets to sd->cache_nice_tries + 3, this *should* trigger an
> active balance, which will either set it to sd->cache_nice_tries+1 or reset
> it to 0. However, in case the to-be-active-balanced task is not allowed to
> run on env->dst_cpu, then the increment is done without any further
> modification.
> 
> This could then be repeated ad nauseam, and would explain the absurdly high
> values reported by syzbot (86, 149). VincentG noted there is value in
> letting sd->cache_nice_tries grow, so the shift itself should be
> fixed. That means preventing:
> 
>   """
>   If the value of the right operand is negative or is greater than or equal
>   to the width of the promoted left operand, the behavior is undefined.
>   """
> 
> Thus we need to cap the shift exponent to
>   BITS_PER_TYPE(typeof(lefthand)) - 1.
> 

Thanks!