xds/clusterimpl: fix uint32 overflow computing EDS drop ratio (grpc#9257)

handleClusterConfigLocked turns each EDS drop_overload into a
per-million rate with `Numerator * million / Denominator` in uint32. The
numerator comes from the control plane and reaches a million for a 100%
drop, so with the million denominator the product overflows a uint32
once the numerator hits 4295 (a 0.43% drop), and the rate then collapses
toward zero: a 50% drop computes to 0.18% and a 100% drop to 0.36%. A
fraction above 100% instead lands `RequestsPerMillion` above a million,
which underflows `million - RequestsPerMillion` in newDropper.

Move the computation into `dropRequestsPerMillion`, which multiplies in
uint64 and caps the ratio at a million. Keeping the clamp next to the
arithmetic that builds DropConfig leaves the raw numerator and
denominator on the parsed resource and applies drops at the configured
rate.

RELEASE NOTES:
* xds: fix xDS EDS drop policies being applied at a much lower rate than
configured due to an integer overflow

Author: nvxbug

internal/xds/balancer/clusterimpl/balancer_test.go

@@ -327,3 +327,30 @@ func (s) TestPickerUpdatedSynchronouslyOnConfigUpdate(t *testing.T) {
 		t.Fatal("Timed out waiting for client conn update to be completed.")
 	}
 }
+
+func (s) TestDropRequestsPerMillion(t *testing.T) {
+	tests := []struct {
+		name        string
+		numerator   uint32
+		denominator uint32
+		want        uint32
+	}{
+		{name: "zero", numerator: 0, denominator: million, want: 0},
+		{name: "five percent hundred", numerator: 5, denominator: 100, want: 50000},
+		// numerator*million overflows a uint32 once numerator reaches 4295 with
+		// the million denominator, which is only a 0.43% drop.
+		{name: "point four three percent million", numerator: 4295, denominator: million, want: 4295},
+		{name: "one percent million", numerator: 10000, denominator: million, want: 10000},
+		{name: "fifty percent million", numerator: 500000, denominator: million, want: 500000},
+		{name: "hundred percent million", numerator: million, denominator: million, want: million},
+		// A fraction above 100% is capped at a million.
+		{name: "over hundred percent", numerator: 150, denominator: 100, want: million},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := dropRequestsPerMillion(tt.numerator, tt.denominator); got != tt.want {
+				t.Errorf("dropRequestsPerMillion(%d, %d) = %d, want %d", tt.numerator, tt.denominator, got, tt.want)
+			}
+		})
+	}
+}

internal/xds/balancer/clusterimpl/clusterimpl.go

@@ -151,6 +151,19 @@ type clusterImplBalancer struct {
 	lrsReportEndpointMetrics *xdsresource.LRSReportEndpointMetricsConfig // LRS metrics to propagate.
 }
 
+// dropRequestsPerMillion scales a drop overload's numerator and denominator to
+// a number of requests to drop per million. numerator can be as large as a
+// million (a 100% drop), so the multiplication is done in uint64 to avoid
+// overflowing a uint32, and the result is capped at a million because a drop
+// ratio above 100% is treated as 100%.
+func dropRequestsPerMillion(numerator, denominator uint32) uint32 {
+	rpm := uint64(numerator) * million / uint64(denominator)
+	if rpm > million {
+		rpm = million
+	}
+	return uint32(rpm)
+}
+
 // handleClusterConfigLocked updates the internal state of the balancer with the
 // new cluster configuration. It returns true if a new picker needs to be
 // generated as a result of these changes. It must be called with b.mu held.
@@ -172,7 +185,7 @@ func (b *clusterImplBalancer) handleClusterConfigLocked(clusterConfig xdsresourc
 		for _, d := range edsUpdate.Drops {
 			newDrops = append(newDrops, DropConfig{
 				Category:           d.Category,
-				RequestsPerMillion: d.Numerator * million / d.Denominator,
+				RequestsPerMillion: dropRequestsPerMillion(d.Numerator, d.Denominator),
 			})
 		}
 		if !slices.Equal(b.dropCategories, newDrops) {