Re: [PATCH] RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc

[Jason Gunthorpe <jgg@nvidia.com>]

On Mon, May 25, 2026 at 05:21:36PM +0300, Yishai Hadas wrote:
> The cpu_id attribute supplied by user space through
> UVERBS_ATTR_ALLOC_DMAH_CPU_ID is passed directly to cpumask_test_cpu()
> without first verifying that the value is within the valid CPU range.
> 
> Passing such untrusted data to cpumask_test_cpu() may lead to an
> out-of-bounds read of the underlying cpumask bitmap: the helper expands
> to a test_bit() that indexes the bitmap by cpu_id / BITS_PER_LONG with
> no bound check.
> 
> In addition, on kernels built with CONFIG_DEBUG_PER_CPU_MAPS it trips
> the WARN_ON_ONCE() in cpumask_check(); combined with panic_on_warn this
> turns a bad user input into a machine reboot.
> 
> Reject any cpu_id that is not smaller than nr_cpu_ids with -EINVAL
> before it is used.
> 
> Reported by Smatch.
> 
> Fixes: d83edab562a4 ("RDMA/core: Introduce a DMAH object and its alloc/free APIs")
> Cc: stable@vger.kernel.org
> Reported-by: Dan Carpenter <error27@gmail.com>
> Closes: https://lore.kernel.org/r/ag68qoAW3P04J7pT@stanley.mountain/
> Signed-off-by: Yishai Hadas <yishaih@nvidia.com>
> ---
>  drivers/infiniband/core/uverbs_std_types_dmah.c | 5 +++++
>  1 file changed, 5 insertions(+)

Applied to for-rc

Thanks,
Jason