Re: [PATCH 1/6] md/raid5: size the worker group array by nr_node_ids

[yu kuai]

在 2026/7/10 21:23, Hiroshi Nishida 写道:

> alloc_thread_groups() sizes conf->worker_groups[] by num_possible_nodes()
> -- the number of possible NUMA nodes -- but raid5_wakeup_stripe_thread()
> indexes it by cpu_to_group(cpu), i.e. cpu_to_node(cpu), which is a node
> id.  When the node map is sparse (for example possible nodes 0 and 2) the
> node count is 2 while the largest node id is 2, so the index reaches
> worker_groups[2] on a two-element array -- an out-of-bounds access.
>
> This has stayed latent because worker groups are only allocated when
> group_thread_cnt is non-zero, and the historical default is 0.  Size the
> array by nr_node_ids -- one past the largest possible node id -- so that
> indexing by cpu_to_node() is always in bounds.  On a dense node map
> nr_node_ids equals num_possible_nodes() and nothing changes; on a sparse
> map the array just gains the unused id slots it needs.
>
> Fixes: 851c30c9badf ("raid5: offload stripe handle to workqueue")
> Signed-off-by: Hiroshi Nishida<nishidafmly@xxxxxxxxx>
> ---
>   drivers/md/raid5.c | 8 +++++++-
>   1 file changed, 7 insertions(+), 1 deletion(-)
Reviewed-by: Yu Kuai <yukuai@xxxxxxx>

-- 
Thanks,
Kuai