diff options
| author |   Yury Norov (NVIDIA) <yury.norov@gmail.com> | 2025-07-19 18:44:43 -0400 |
|---|---|---|
| committer |   Jason A. Donenfeld <Jason@zx2c4.com> | 2025-09-08 18:50:41 +0200 |
| commit | 1740e686e369cebc08cd93cc5a02075ecee40d09 (patch) | |
| tree | 5989f9a8a04e40d16c6bb80eb212f9c442918f7f /drivers/net/wireless/intel/iwlwifi/mld/tests/utils.c | |
| parent | wireguard: queueing: simplify wg_cpumask_next_online() (diff) | |
| download | wireguard-linux-1740e686e369cebc08cd93cc5a02075ecee40d09.tar.xz wireguard-linux-1740e686e369cebc08cd93cc5a02075ecee40d09.zip | |
wireguard: queueing: always return valid online CPU in wg_cpumask_choose_online()
The function gets number of online CPUS, and uses it to search for
Nth cpu in cpu_online_mask.
If id == num_online_cpus() - 1, and one CPU gets offlined between
calling num_online_cpus() -> cpumask_nth(), there's a chance for
cpumask_nth() to find nothing and return >= nr_cpu_ids.
The caller code in __queue_work() tries to avoid that by checking the
returned CPU against WORK_CPU_UNBOUND, which is NR_CPUS. It's not the
same as '>= nr_cpu_ids'. On a typical Ubuntu desktop, NR_CPUS is 8192,
while nr_cpu_ids is the actual number of possible CPUs, say 8.
The non-existing cpu may later be passed to rcu_dereference() and
corrupt the logic. Fix it by switching from 'if' to 'while'.
Suggested-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Yury Norov (NVIDIA) <yury.norov@gmail.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Diffstat (limited to 'drivers/net/wireless/intel/iwlwifi/mld/tests/utils.c')
0 files changed, 0 insertions, 0 deletions