On Tue, Sep 17, 2019 at 08:48:54PM +0800, Yunsheng Lin wrote: > When passing the return value of dev_to_node() to cpumask_of_node() > without checking if the device's node id is NUMA_NO_NODE, there is > global-out-of-bounds detected by KASAN. > > From the discussion [1], NUMA_NO_NODE really means no node affinity, > which also means all cpus should be usable. So the cpumask_of_node() > should always return all cpus online when user passes the node id as > NUMA_NO_NODE, just like similar semantic that page allocator handles > NUMA_NO_NODE. > > But we cannot really copy the page allocator logic. Simply because the > page allocator doesn't enforce the near node affinity. It just picks it > up as a preferred node but then it is free to fallback to any other numa > node. This is not the case here and node_to_cpumask_map will only restrict > to the particular node's cpus which would have really non deterministic > behavior depending on where the code is executed. So in fact we really > want to return cpu_online_mask for NUMA_NO_NODE. > > Also there is a debugging version of node_to_cpumask_map() for x86 and > arm64, which is only used when CONFIG_DEBUG_PER_CPU_MAPS is defined, this > patch changes it to handle NUMA_NO_NODE as normal node_to_cpumask_map(). > > [1] https://lore.kernel.org/patchwork/patch/1125789/ That is bloody unusable, don't do that. Use: https://lkml.kernel.org/r/$MSGID if anything. Then I can find it in my local mbox without having to resort to touching a mouse and shitty browser software. (also patchwork is absolute crap for reading email threads) Anyway, I found it -- I think, I refused to click the link. I replied there. > Signed-off-by: Yunsheng Lin <linyunsheng@xxxxxxxxxx> > Suggested-by: Michal Hocko <mhocko@xxxxxxxxxx> > Acked-by: Michal Hocko <mhocko@xxxxxxxx> > diff --git a/arch/x86/mm/numa.c b/arch/x86/mm/numa.c > index 4123100e..9859acb 100644 > --- a/arch/x86/mm/numa.c > +++ b/arch/x86/mm/numa.c > @@ -861,6 +861,9 @@ void numa_remove_cpu(int cpu) > */ > const struct cpumask *cpumask_of_node(int node) > { > + if (node == NUMA_NO_NODE) > + return cpu_online_mask; This mandates the caller holds cpus_read_lock() or something, I'm pretty sure that if I put: lockdep_assert_cpus_held(); here, it comes apart real quick. Without holding the cpu hotplug lock, the online mask is gibberish. > + > if ((unsigned)node >= nr_node_ids) { > printk(KERN_WARNING > "cpumask_of_node(%d): (unsigned)node >= nr_node_ids(%u)\n", I still think this makes absolutely no sense what so ever.
