Re: [PATCH] scsi: mpt3sas: avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()

[John Garry]

On 17/08/2026 23:13, Ivy Lopez wrote:
> dev_to_node() can return NUMA_NO_NODE (-1) on systems without NUMA
> topology information for the PCI device, such as single-socket
> boards that don't expose device-to-node affinity. 

I think that this problem would have appeared by now for this driver (if 
it were really a problem).

However, for CONFIG_NUMA=n dev_to_node() always returns NUMA_NO_NODE.

> Passing -1
> directly into cpumask_of_node() indexes node_to_cpumask_map[-1],
> an out-of-bounds array read caught by UBSAN:
>
>    UBSAN: array-index-out-of-bounds in arch/x86/include/asm/topology.h:72:28
>    index -1 is out of range for type 'cpumask *[1024]'

x86 seems to be only arch which has this problem now.

I have tried unsuccessfully to fix it:
https://lore.kernel.org/lkml/20260107094007.966496-5-john.g.garry@xxxxxxxxxx/