linux-kernel - Re: [v2] x86/numa: Initialize __apicid_to_node in dummy_numa

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID:
 <SYBPR01MB3900A7DB9F78B00708C7A130D994A@SYBPR01MB3900.ausprd01.prod.outlook.com>
Date: Fri, 23 Jan 2026 19:31:01 +0800
From: Yi Li <adamliyi@....com>
To: Mouse Zhang <mousezhang7@...il.com>
Cc: bp@...en8.de, dave.hansen@...ux.intel.com, hpa@...or.com,
 linux-kernel@...r.kernel.org, luto@...nel.org, mingo@...hat.com,
 peterz@...radead.org, tglx@...nel.org, x86@...nel.org
Subject: Re: [v2] x86/numa: Initialize __apicid_to_node in dummy_numa_init()
 to prevent OOB

Hi Mouse Zhang,

On 1/16/2026 4:56 PM, Mouse Zhang wrote:
> When NUMA is disabled (numa=off) or the BIOS does not provide an SRAT
> table, the kernel falls back to dummy_numa_init(). This function fakes
> a single node (Node 0) and maps all memory to it, but it leaves the
> __apicid_to_node[] mapping table uninitialized (filled with NUMA_NO_NODE).
> 

I agree about setting '__apicid_to_node[apicid] = 0' in dummy_numa_init().
Both x86_acpi_numa_init() and amd_numa_init() initialize __apicid_to_node[].
I think dummy_numa_init() should initialize __apicid_to_node[] too.

> This leads to a potential out-of-bounds access in srat_detect_node()
> and other topology-related code. Specifically, when numa_cpu_node()
> returns NUMA_NO_NODE, some code paths attempt to use cpu_llc_id as a
> fallback for the node ID. On modern systems with large APIC IDs, the
> cpu_llc_id (derived from APIC ID) can exceed MAX_NUMNODES. Using this
> invalid ID in functions like node_online(node) causes memory corruption
> or kernel panic.
> 
> Fix this by explicitly mapping all unassigned APIC IDs to Node 0 in
> dummy_numa_init(). This ensures that numa_cpu_node() consistently
> returns Node 0 in non-NUMA environments, avoiding dangerous fallbacks
> and keeping the mapping consistent with the fake Node 0.
> 
> Signed-off-by: Mouse Zhang <mousezhang7@...il.com>
> ---
> Fix bad format.
>   arch/x86/mm/numa.c | 8 ++++++++
>   1 file changed, 8 insertions(+)
> 
> diff --git a/arch/x86/mm/numa.c b/arch/x86/mm/numa.c
> index 7a97327140df..f78b3ff7a67e 100644
> --- a/arch/x86/mm/numa.c
> +++ b/arch/x86/mm/numa.c
> @@ -212,6 +212,14 @@ static int __init dummy_numa_init(void)
>   	node_set(0, numa_nodes_parsed);
>   	numa_add_memblk(0, 0, PFN_PHYS(max_pfn));
>   
> +	/* Map all unassociated APIC IDs to the fake node 0 */
> +	unsigned int apicid;
> +
> +	for (apicid = 0; apicid < MAX_LOCAL_APIC; apicid++) {
> +		if (__apicid_to_node[apicid] == NUMA_NO_NODE)

Is numa_cpu_node() better? Do we need to check this conditional at all?

> +			__apicid_to_node[apicid] = 0;

set_apicid_to_node(apicid, 0) looks better.
x86_acpi_numa_init() and amd_numa_init() use set_apicid_to_node().

> +	}
> +
>   	return 0;
>   }
>   

Thanks,
-Yi