Re: [PATCH 11/23] hrtimer: Use RCU to protect access of HK_TYPE_TIMER cpumask

[sashiko-bot@kernel.org]

Sashiko AI review found 1 potential issue(s):
- [High] Missing bounds check on the CPU index returned by cpumask_any_and(), leading to potential out-of-bounds array access in per_cpu().
--

commit 9c505fb411d64c62ba8b88daa1385610377293b4
Author: Waiman Long <longman@redhat.com>

hrtimer: Use RCU to protect access of HK_TYPE_TIMER cpumask

This commit updates the housekeeping cpumask access in get_target_base() to
be protected by an RCU read lock. This change prepares for the HK_TYPE_TIMER
cpumask becoming changeable at runtime.

> diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
> index 5bd6efe598f0f..bc3652f928b9d 100644
> --- a/kernel/time/hrtimer.c
> +++ b/kernel/time/hrtimer.c
> @@ -242,8 +242,10 @@ static bool hrtimer_suitable_target(struct hrtimer *timer, struct hrtimer_clock_
>  static inline struct hrtimer_cpu_base *get_target_base(struct hrtimer_cpu_base *base, bool pinned)
>  {
>  	if (!hrtimer_base_is_online(base)) {
> -		int cpu = cpumask_any_and(cpu_online_mask, housekeeping_cpumask(HK_TYPE_TIMER));
> +		int cpu;
>  
> +		guard(rcu)();
> +		cpu = cpumask_any_and(cpu_online_mask, housekeeping_cpumask(HK_TYPE_TIMER));

As dynamic runtime updates of the housekeeping masks are being enabled, is it
possible for the intersection of cpu_online_mask and
housekeeping_cpumask(HK_TYPE_TIMER) to be empty?

If all housekeeping CPUs are offlined, cpumask_any_and() could return a value
greater than or equal to nr_cpu_ids.

>  		return &per_cpu(hrtimer_bases, cpu);

If cpu is greater than or equal to nr_cpu_ids, could this lead to an
out-of-bounds array access in per_cpu()?

Would it make sense to add a bounds check here to fall back safely if an
online housekeeping CPU is not found?

>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260421030351.281436-1-longman@redhat.com?part=11