Skip to content

validation: compare the pids limit by value - #814

Open
dangowrt wants to merge 1 commit into
opencontainers:masterfrom
dangowrt:pids-limit-value
Open

dangowrt wants to merge 1 commit into
opencontainers:masterfrom
dangowrt:pids-limit-value

Conversation

@dangowrt

Copy link
Copy Markdown
Contributor

ValidateLinuxResourcesPids compares lpd.Limit with config.Linux.Resources.Pids.Limit using ==. Those were int64 values when the check was written, but LinuxPids.Limit became *int64 in runtime-spec v1.3.0, which came in with b521900, and the comparison silently became one between two pointers that are freshly allocated on each side and so are never equal.

The result is that "pids limit is set correctly" has failed for every runtime on every cgroup hierarchy since that bump, in linux_cgroups_pids, linux_cgroups_relative_pids and delete_resources, and the diagnostic printed two addresses rather than the limits, which is what makes it easy to miss: # expect: 55915624612248, actual: 55915627741456. This dereferences both sides, and reports a limit that is absent on either of them as a diagnostic instead of dereferencing a nil pointer.

LinuxPids.Limit became a pointer when commit b521900 ("go.{mod,sum}:
bump runtime-spec to v1.3.0.") moved to runtime-spec v1.3.0, and the
check turned into a comparison of two pointers that are never equal. The
pids limit check has failed for every runtime since, and the diagnostic
printed two addresses instead of the limits.

Dereference both sides, and report a limit that is missing on either of
them as a diagnostic rather than dereferencing a nil pointer.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant