kubernetes-sigs / karpenter / 29667096217

82%

main: 82%

Build Type

Pull #3156

github

Committed by thc1006

Commit Message

fix: prevent int64 overflow, negative credit, and nil Min panic in DRA consumable-capacity

The DRA consumable-capacity helpers (hand-copied from k8s.io/dynamic-resource-allocation) had three ways to produce a wrong or unsafe result from a request or a cloud-provider device-capacity template that the API server does not validate. roundUpRange did the rounding in int64 after Quantity.Value()/MilliValue(), which truncates out-of-int64 values, so a request/Min/Step above MaxInt64, a non-positive Step, or an overflowing Min+N*Step produced a negative or wrong consumed value; it now guards every operand with CmpInt64/Sign before Value() and detects the multiply overflow in int64, returning the request unchanged so the exact comparisons reject it. computeConsumedCapacity stored a negative consumed value (a negative request with no policy, or a negative RequestPolicy.Default for an empty request) as a negative credit that over-admits the device; it now rejects a negative consumed value. violateValidRange dereferenced ValidRange.Min without a nil check when Step was set, panicking on a template with a Step but no Min; it now treats a nil Min as a violation (fail-closed). Tests exercise computeConsumedCapacity directly and the roundUpRange/violateValidRange boundaries; the full dynamicresources envtest suite passes.

Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>

Pull Request Pull Request #3156: fix: prevent int64 overflow and divide-by-zero in DRA consumable-capacity rounding

Coverage Stats

29 of 31 new or added lines in 1 file covered. (93.55%)

20 existing lines in 1 file now uncovered.

16596 of 20120 relevant lines covered (82.49%)

97321.27 hits per line