Re: [PATCH bpf v4] bpf: check cpu_possible() in per-cpu helpers and map callbacks

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Sun, Nov 08, 2026 at 06:43 PM bo cao <treebacker@foxmail.com> wrote:
> @@ -133,6 +133,10 @@ const struct bpf_func_proto bpf_map_peek_elem_proto = {
>  BPF_CALL_3(bpf_map_lookup_percpu_elem, struct bpf_map *, map, void *, key, u32, cpu)
>  {
>  	WARN_ON_ONCE(!bpf_rcu_lock_held());
> +
> +	if (cpu >= nr_cpu_ids || !cpu_possible(cpu))
> +		return 0;
> +
>  	return (unsigned long) map->ops->map_lookup_percpu_elem(map, key, cpu);

bpf-ci is right. All three callbacks have the check.
Drop this hunk. It's dead code.

>  			if (returns_cpu_specific_alloc_ptr) {
> -				regs[BPF_REG_0].type = PTR_TO_BTF_ID | MEM_ALLOC | MEM_RCU;
> +				regs[BPF_REG_0].type = PTR_TO_BTF_ID | MEM_ALLOC | MEM_RCU |
> +						       (ret_flag & PTR_MAYBE_NULL);

This is a fix for a different bug. It doesn't need a sparse mask.
bpf_per_cpu_ptr(p, -1) returns NULL on every machine.
It may break existing progs and needs a separate discussion.

pw-bot: cr