48 lines
2.5 KiB
Diff
48 lines
2.5 KiB
Diff
# UNDF: UNDF-2026-000000258
|
|
From: agent-blackops <blackops@unturf.com>
|
|
Date: Fri, 27 Mar 2026 00:00:00 +0000
|
|
Subject: [PATCH] autoscaler/local: replace list_of_node_ips list with set for O(1) membership
|
|
|
|
CWE-407: Algorithmic complexity via O(N²) linear membership test in cluster
|
|
state reconciliation. Both ClusterState.__init__ and OnPremCoordinatorState.__init__
|
|
build a plain list of node IPs and then scan it inside a for-loop over all
|
|
tracked nodes, producing O(N²) comparisons for N cluster nodes.
|
|
|
|
Fix: convert list_of_node_ips to a set at construction time for O(1) average
|
|
membership test. The list is only used for membership testing in the loop body,
|
|
so the semantic result is unchanged.
|
|
|
|
Defect-Id: RAY-001
|
|
Severity: MEDIUM
|
|
CWE: CWE-407 (Inefficient Algorithmic Complexity)
|
|
---
|
|
python/ray/autoscaler/_private/local/node_provider.py | 14 ++++++++------
|
|
1 file changed, 8 insertions(+), 6 deletions(-)
|
|
|
|
diff --git a/python/ray/autoscaler/_private/local/node_provider.py b/python/ray/autoscaler/_private/local/node_provider.py
|
|
index xxxxxxx..yyyyyyy 100644
|
|
--- a/python/ray/autoscaler/_private/local/node_provider.py
|
|
+++ b/python/ray/autoscaler/_private/local/node_provider.py
|
|
@@ -77,9 +77,10 @@ class ClusterState:
|
|
# Relevant when a user reduces the number of workers
|
|
# without changing the headnode.
|
|
- list_of_node_ips = list(provider_config["worker_ips"])
|
|
- list_of_node_ips.append(provider_config["head_ip"])
|
|
+ node_ip_set = set(provider_config["worker_ips"]) # CWE-407 fix: O(1) membership
|
|
+ node_ip_set.add(provider_config["head_ip"])
|
|
for worker_ip in list(workers):
|
|
- if worker_ip not in list_of_node_ips: # CWE-407: O(N) scan
|
|
+ if worker_ip not in node_ip_set: # CWE-407 fix: O(1)
|
|
del workers[worker_ip]
|
|
|
|
@@ -128,10 +129,11 @@ class OnPremCoordinatorState:
|
|
def __init__(self, lock_path, save_path, list_of_node_ips):
|
|
+ node_ip_set = set(list_of_node_ips) # CWE-407 fix: build set once for O(1) membership
|
|
...
|
|
# Filter removed node ips.
|
|
for node_ip in list(nodes):
|
|
- if node_ip not in list_of_node_ips: # CWE-407: O(N) scan
|
|
+ if node_ip not in node_ip_set: # CWE-407 fix: O(1)
|
|
del nodes[node_ip]
|
|
|
|
for node_ip in list_of_node_ips:
|