The page_frag selftest module accepts test_push_cpu and test_pop_cpu as signed module parameters, then validates them by passing them directly to cpu_active().
That validation is itself unsafe for negative or out-of-range CPU numbers. For example, test_push_cpu=-1 is converted to a very large unsigned CPU number before cpu_active() reaches cpumask_test_cpu(), which trips the cpumask range check with CONFIG_DEBUG_PER_CPU_MAPS enabled. Reject CPU values outside [0, nr_cpu_ids) before asking whether the CPU is active. Assisted-by: Codex:gpt-5.5-cyber-preview Signed-off-by: Samuel Moelius <[email protected]> --- tools/testing/selftests/mm/page_frag/page_frag_test.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tools/testing/selftests/mm/page_frag/page_frag_test.c b/tools/testing/selftests/mm/page_frag/page_frag_test.c index e806c1866e36..c8584d0fdeab 100644 --- a/tools/testing/selftests/mm/page_frag/page_frag_test.c +++ b/tools/testing/selftests/mm/page_frag/page_frag_test.c @@ -131,6 +131,8 @@ static int __init page_frag_test_init(void) init_completion(&wait); if (test_alloc_len > PAGE_SIZE || test_alloc_len <= 0 || + test_push_cpu < 0 || test_push_cpu >= nr_cpu_ids || + test_pop_cpu < 0 || test_pop_cpu >= nr_cpu_ids || !cpu_active(test_push_cpu) || !cpu_active(test_pop_cpu)) return -EINVAL; -- 2.43.0
