Re: [PATCH v2 9/9] perf/cxl: Avoid cpumask_of(-1) when no CPU is assigned

[Jonathan Cameron <jic23@kernel.org>]

On Wed, 29 Jul 2026 07:55:55 -0700
Dave Jiang <dave.jiang@intel.com> wrote:

> cpumask_show() feeds info->on_cpu straight into cpumask_of() for the
> world-readable cpumask sysfs attribute. on_cpu is -1 before the first
> hotplug online callback and transiently in cxl_pmu_offline_cpu() before a
> new target is chosen. cpumask_of(-1) treats the CPU number as unsigned and
> does out-of-bounds pointer arithmetic in get_cpu_mask(), so a concurrent
> read of the attribute dereferences a wild pointer and can fault -- a local
> denial of service.
> 

I'm not keen on the solution here. 

The transient state is ugly anyway. We can just move setting it to -1 into
the dummy code that deals with that well known case of you have CPUs online
and code is still running.

The init case looks like a false positive to me.  But maybe I'm missing stuff.
The perf registration that surfaces the sysfs happens after hotplug handler is
added and I believe that synchronously runs it for CPUs that are already up.
Given we are running code (and CXL stuff isn't super early) something will
be up so it won't remain -1 by the time of use.

Can we just use the generic stuff?  Maybe need Robin's stuff to add init / exit
per driver calls. 
https://lore.kernel.org/linux-arm-kernel/cover.1784911757.git.robin.murphy@arm.com/

In general, I'd like Robin to take a quick look at the more generic perf
parts of this series given he has clearly been deep in this stuff a lot
more recently than me :)

Jonathan

> Read on_cpu once and emit an empty mask when it is negative.
> 
> Fixes: 5d7107c72796 ("perf: CXL Performance Monitoring Unit driver")
> Reported-by: sashiko-bot@kernel.org
> Closes: https://sashiko.dev/#/patchset/20260715191454.459673-1-dave@stgolabs.net?part=1
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Dave Jiang <dave.jiang@intel.com>
> ---
>  drivers/perf/cxl_pmu.c | 11 ++++++++++-
>  1 file changed, 10 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/perf/cxl_pmu.c b/drivers/perf/cxl_pmu.c
> index f42238b2b6b0..6aad381c0376 100644
> --- a/drivers/perf/cxl_pmu.c
> +++ b/drivers/perf/cxl_pmu.c
> @@ -501,8 +501,17 @@ static ssize_t cpumask_show(struct device *dev, struct device_attribute *attr,
>  			    char *buf)
>  {
>  	struct cxl_pmu_info *info = dev_get_drvdata(dev);
> +	int cpu = READ_ONCE(info->on_cpu);
>  
> -	return cpumap_print_to_pagebuf(true, buf, cpumask_of(info->on_cpu));
> +	/*
> +	 * on_cpu is -1 before the first online callback and transiently during
> +	 * cxl_pmu_offline_cpu(). cpumask_of(-1) computes an out-of-bounds
> +	 * pointer, so report an empty mask instead.
> +	 */
> +	if (cpu < 0)
> +		return sysfs_emit(buf, "\n");
> +
> +	return cpumap_print_to_pagebuf(true, buf, cpumask_of(cpu));
>  }
>  static DEVICE_ATTR_RO(cpumask);
>