From 5bd8de20770ca001621bb1aa5eb9a0977d0bd2d9 Mon Sep 17 00:00:00 2001 From: "Yury Norov (NVIDIA)" Date: Wed, 10 Sep 2025 03:36:42 +0200 Subject: [PATCH] wireguard: queueing: always return valid online CPU in wg_cpumask_choose_online() The function gets number of online CPUS, and uses it to search for Nth cpu in cpu_online_mask. If id == num_online_cpus() - 1, and one CPU gets offlined between calling num_online_cpus() -> cpumask_nth(), there's a chance for cpumask_nth() to find nothing and return >= nr_cpu_ids. The caller code in __queue_work() tries to avoid that by checking the returned CPU against WORK_CPU_UNBOUND, which is NR_CPUS. It's not the same as '>= nr_cpu_ids'. On a typical Ubuntu desktop, NR_CPUS is 8192, while nr_cpu_ids is the actual number of possible CPUs, say 8. The non-existing cpu may later be passed to rcu_dereference() and corrupt the logic. Fix it by switching from 'if' to 'while'. Suggested-by: Jason A. Donenfeld Signed-off-by: Yury Norov (NVIDIA) Signed-off-by: Jason A. Donenfeld Link: https://patch.msgid.link/20250910013644.4153708-3-Jason@zx2c4.com Signed-off-by: Jakub Kicinski --- drivers/net/wireguard/queueing.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireguard/queueing.h b/drivers/net/wireguard/queueing.h index 56314f98b6bac..79b6d70de236b 100644 --- a/drivers/net/wireguard/queueing.h +++ b/drivers/net/wireguard/queueing.h @@ -106,7 +106,7 @@ static inline int wg_cpumask_choose_online(int *stored_cpu, unsigned int id) { unsigned int cpu = *stored_cpu; - if (unlikely(cpu >= nr_cpu_ids || !cpu_online(cpu))) + while (unlikely(cpu >= nr_cpu_ids || !cpu_online(cpu))) cpu = *stored_cpu = cpumask_nth(id % num_online_cpus(), cpu_online_mask); return cpu; -- 2.47.3