On Sun, 25 Oct 2026 01:25:52 +0900 "Masami Hiramatsu (Google)" <[email protected]> wrote:
> From: Masami Hiramatsu (Google) <[email protected]> > > In parse_pred(), single-CPU cpumask filters are parsed via cpulist_parse(), > which checks against nr_cpumask_bits (NR_CPUS). When NR_CPUS > nr_cpu_ids, > a user can provide a CPU number where cpu >= nr_cpu_ids. > > When evaluating such a predicate in filter_pred_cpumask_cpu(), > do_filter_cpumask_scalar() calls cpumask_test_cpu(cpu, mask) without > checking cpu against nr_cpu_ids. This triggers a WARN_ON_ONCE under > CONFIG_DEBUG_PER_CPU_MAPS and causes an out-of-bounds bit test. > > Check "cpu >= nr_cpu_ids" at the start of do_filter_cpumask_scalar(). When > the CPU index is out of bounds, return "op == OP_NE" since an out-of-range > CPU is never present in a valid cpumask. > > Fixes: 38c6f6808389 ("tracing/filters: Further optimise scalar vs cpumask > comparison") > Cc: [email protected] > Signed-off-by: Masami Hiramatsu (Google) <[email protected]> > --- > kernel/trace/trace_events_filter.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/kernel/trace/trace_events_filter.c > b/kernel/trace/trace_events_filter.c > index c2c35b4de85e..69da95f42541 100644 > --- a/kernel/trace/trace_events_filter.c > +++ b/kernel/trace/trace_events_filter.c > @@ -695,6 +695,9 @@ do_filter_scalar_cpumask(int op, unsigned int cpu, const > struct cpumask *mask) > static inline int > do_filter_cpumask_scalar(int op, const struct cpumask *mask, unsigned int > cpu) > { > + if (cpu >= nr_cpu_ids) > + return op == OP_NE; > + > switch (op) { > case OP_EQ: > return cpumask_test_cpu(cpu, mask) && I wonder if we should just make the filter fail with -EINVAL, and not let it get this far. -- Steve
