kubernetes-sigs / karpenter / 29668958736

82%

main: 82%

Pull #3156

github

fix: prevent int64 overflow, negative credit, and nil Min panic in DRA consumable-capacity

The DRA consumable-capacity helpers (hand-copied from k8s.io/dynamic-resource-allocation) could produce a wrong or unsafe consumed-capacity value from a request or a cloud-provider device-capacity template that the API server does not validate. roundUpRange rounded in int64 after Quantity.Value(), which truncates values outside the int64 range, so a request/Min/Step above MaxInt64, a non-positive Step, or an overflowing Min+N*Step produced a negative or wrong value; it now guards every operand with CmpInt64/Sign before Value() and detects the multiply overflow in int64. computeConsumedCapacity stored a negative consumed value (a negative request with no policy, or a negative RequestPolicy.Default) as a negative credit that over-admits the device; it now rejects a negative consumed value. checkCapacity summed the persisted sources (Preallocated/Inflight/allocating and template variants) without a sign check, so a negative ConsumedCapacity ingested from a ResourceClaim status could offset the used total and over-admit; it now fails closed on any negative total, request, or source. violateValidRange dereferenced ValidRange.Min without a nil check when Step was set (panicking on a Step-but-no-Min template), and the Default short-circuit in violatesPolicy accepted a value matching Default without checking the range structure; a shared invalidRange helper now treats a nil/negative/non-representable Min or a non-positive Step as a violation, checked before the Default short-circuit. Tests exercise computeConsumedCapacity and checkCapacity directly plus the roundUpRange/violateValidRange boundaries (including the n++ equality boundary); the full dynamicresources envtest suite passes.

Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>

43 of 45 new or added lines in 1 file covered. (95.56%)

16605 of 20131 relevant lines covered (82.48%)

97590.99 hits per line