Skip to content

Commit 0000501

Browse files
committed
Fix divide-by-zero in MCTS fixed_log overflow
In fixed_log, the divisor (v + (1U << FIXED_SCALE_BITS)) is computed in 32-bit arithmetic. When v = 0xFFFF0000 (n_total=65535, so n_total<<16), the addition overflows to zero, triggering a kernel Oops (divide error) inside the kxod workqueue via ai_one_work_func -> play_agent_move -> mcts. This crashes the kworker, leaves the module refcount elevated, and makes rmmod hang forever, which is CI timeout seen in integration-tests job. Cast v to u64 before the addition so denominator is computed in 64-bit and cannot wrap to zero.
1 parent 00008d6 commit 0000501

2 files changed

Lines changed: 3 additions & 2 deletions

File tree

scripts/aspell-pws

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -159,6 +159,7 @@ xor
159159
xoro
160160
xoroshiro
161161
prng
162+
MCTS
162163
ksort
163164
cmwq
164165
workqueue

src/mcts.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -63,8 +63,8 @@ static fixed_point_t fixed_log(fixed_point_t v)
6363
numerator = (1U << 31) - numerator;
6464
}
6565

66-
fixed_point_t y =
67-
((u64) numerator << FIXED_SCALE_BITS) / (v + (1U << FIXED_SCALE_BITS));
66+
fixed_point_t y = ((u64) numerator << FIXED_SCALE_BITS) /
67+
((u64) v + (1U << FIXED_SCALE_BITS));
6868

6969
fixed_point_t ans = 0U;
7070
for (unsigned i = 1; i < 20; i += 2) {

0 commit comments

Comments
 (0)