diff options
| author | Yury Norov (NVIDIA) <yury.norov@gmail.com> | 2025-09-10 03:36:42 +0200 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2025-09-11 18:52:21 -0700 |
| commit | 5bd8de20770ca001621bb1aa5eb9a0977d0bd2d9 (patch) | |
| tree | 31a2d7322dbbcc9351e96a4bdbca7fc19f613656 /drivers/net/wireguard/queueing.h | |
| parent | 5551d21284702a5f36791aecc7735870d0423996 (diff) | |
wireguard: queueing: always return valid online CPU in wg_cpumask_choose_online()
The function gets number of online CPUS, and uses it to search for
Nth cpu in cpu_online_mask.
If id == num_online_cpus() - 1, and one CPU gets offlined between
calling num_online_cpus() -> cpumask_nth(), there's a chance for
cpumask_nth() to find nothing and return >= nr_cpu_ids.
The caller code in __queue_work() tries to avoid that by checking the
returned CPU against WORK_CPU_UNBOUND, which is NR_CPUS. It's not the
same as '>= nr_cpu_ids'. On a typical Ubuntu desktop, NR_CPUS is 8192,
while nr_cpu_ids is the actual number of possible CPUs, say 8.
The non-existing cpu may later be passed to rcu_dereference() and
corrupt the logic. Fix it by switching from 'if' to 'while'.
Suggested-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Yury Norov (NVIDIA) <yury.norov@gmail.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Link: https://patch.msgid.link/20250910013644.4153708-3-Jason@zx2c4.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'drivers/net/wireguard/queueing.h')
| -rw-r--r-- | drivers/net/wireguard/queueing.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireguard/queueing.h b/drivers/net/wireguard/queueing.h index 56314f98b6ba..79b6d70de236 100644 --- a/drivers/net/wireguard/queueing.h +++ b/drivers/net/wireguard/queueing.h @@ -106,7 +106,7 @@ static inline int wg_cpumask_choose_online(int *stored_cpu, unsigned int id) { unsigned int cpu = *stored_cpu; - if (unlikely(cpu >= nr_cpu_ids || !cpu_online(cpu))) + while (unlikely(cpu >= nr_cpu_ids || !cpu_online(cpu))) cpu = *stored_cpu = cpumask_nth(id % num_online_cpus(), cpu_online_mask); return cpu; |