Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] A CPU hotplug offline operation can lead to a NULL pointer dereference in `mshv_vp_dispatch` because user tasks can still execute on the offlining CPU after the per-CPU buffers have been freed. -- commit 182b63fe189dbbf1da723a03d972eaa7cbb71f56 Author: Can Peng <[email protected]> drivers: hv: use kmalloc_array in mshv_root_scheduler_init Replace kmalloc() with kmalloc_array() to prevent potential overflow, as recommended in Documentation/process/deprecated.rst. > diff --git a/drivers/hv/mshv_root_main.c b/drivers/hv/mshv_root_main.c > index bd1359eb58dd4..146726cc4e9ba 100644 > --- a/drivers/hv/mshv_root_main.c > +++ b/drivers/hv/mshv_root_main.c > @@ -2241,7 +2241,7 @@ static int mshv_root_scheduler_init(unsigned int cpu) > outputarg = (void **)this_cpu_ptr(root_scheduler_output); > > /* Allocate two consecutive pages. One for input, one for output. */ > - p = kmalloc(2 * HV_HYP_PAGE_SIZE, GFP_KERNEL); > + p = kmalloc_array(2, HV_HYP_PAGE_SIZE, GFP_KERNEL); ^^^^^^^^^^^^^ [Severity: High] This isn't a bug introduced by this patch, but is there a pre-existing issue where a CPU hotplug offline operation can lead to a NULL pointer dereference in mshv_vp_dispatch()? The CPU hotplug teardown callback mshv_root_scheduler_cleanup() is registered at CPUHP_AP_ONLINE_DYN. During a CPU offline operation, it frees the per-CPU buffers and sets the pointers to NULL: drivers/hv/mshv_root_main.c:mshv_root_scheduler_cleanup() { ... *inputarg = NULL; *outputarg = NULL; ... } User tasks can still execute on the offlining CPU at this high state in the offline sequence. If a vCPU thread scheduled on the offlining CPU invokes mshv_vp_dispatch() after the teardown callback has run, it unconditionally dereferences the input buffer: drivers/hv/mshv_root_main.c:mshv_vp_dispatch() { ... preempt_disable(); input = *this_cpu_ptr(root_scheduler_input); ... memset(input, 0, sizeof(*input)); ... } Does this sequence result in a NULL pointer dereference if the input buffer pointer has already been cleared by the cleanup callback? > if (!p) > return -ENOMEM; > -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
