Re: [PATCH 03/10] tracing/filters: Check CPU bounds before cpumask_test_cpu() in do_filter_cpumask_scalar()

[Steven Rostedt]

On Sun, 25 Oct 2026 01:25:52 +0900
"Masami Hiramatsu (Google)" <mhiramat@xxxxxxxxxx> wrote:

> From: Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>
> 
> In parse_pred(), single-CPU cpumask filters are parsed via cpulist_parse(),
> which checks against nr_cpumask_bits (NR_CPUS). When NR_CPUS > nr_cpu_ids,
> a user can provide a CPU number where cpu >= nr_cpu_ids.
> 
> When evaluating such a predicate in filter_pred_cpumask_cpu(),
> do_filter_cpumask_scalar() calls cpumask_test_cpu(cpu, mask) without
> checking cpu against nr_cpu_ids. This triggers a WARN_ON_ONCE under
> CONFIG_DEBUG_PER_CPU_MAPS and causes an out-of-bounds bit test.
> 
> Check "cpu >= nr_cpu_ids" at the start of do_filter_cpumask_scalar(). When
> the CPU index is out of bounds, return "op == OP_NE" since an out-of-range
> CPU is never present in a valid cpumask.
> 
> Fixes: 38c6f6808389 ("tracing/filters: Further optimise scalar vs cpumask comparison")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>
> ---
>  kernel/trace/trace_events_filter.c |    3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
> index c2c35b4de85e..69da95f42541 100644
> --- a/kernel/trace/trace_events_filter.c
> +++ b/kernel/trace/trace_events_filter.c
> @@ -695,6 +695,9 @@ do_filter_scalar_cpumask(int op, unsigned int cpu, const struct cpumask *mask)
>  static inline int
>  do_filter_cpumask_scalar(int op, const struct cpumask *mask, unsigned int cpu)
>  {
> +	if (cpu >= nr_cpu_ids)
> +		return op == OP_NE;
> +
>  	switch (op) {
>  	case OP_EQ:
>  		return cpumask_test_cpu(cpu, mask) &&

I wonder if we should just make the filter fail with -EINVAL, and not let
it get this far.

-- Steve