* [ndctl PATCH RESEND] test/cxl-mbox: Regression test for huge CXL_MEM_SEND_COMMAND out.size @ 2026-06-24 15:01 Richard Cheng 2026-09-15 0:55 ` Alison Schofield 0 siblings, 1 reply; 3+ messages in thread From: Richard Cheng @ 2026-06-24 15:01 UTC (permalink / raw) To: dave, jic23, dave.jiang, alison.schofield, vishal.l.verma, djbw, danwilliams, nvdimm Cc: iweiny, ming.li, kobak, kaihengf, kees, newtonl, kristinc, mochs, linux-cxl, linux-kernel, Richard Cheng Implement a regression test for unbounded kvzalloc() in the kernel's cxl_mbox_cmd_ctor(), which a CXL_MEM_SEND_COMMAND with an out.size greater than INT_MAX could drive into a size > INT_MAX kvmalloc() WARN. libcxl's cxl_cmd_set_output_payload() rejects an out.size larger than the mailbox payload_max, so the test crafts a raw struct cxl_send_command and issues the CXL_MEM_SEND_COMMAND ioctl directly against the cxl_test mock memdev. The test is for a kernel bug fix [1]. [1]: https://lore.kernel.org/all/20260624144147.53997-1-icheng@nvidia.com/ Signed-off-by: Richard Cheng <icheng@nvidia.com> --- test/cxl-mbox.c | 129 +++++++++++++++++++++++++++++++++++++++++++++++ test/cxl-mbox.sh | 48 ++++++++++++++++++ 2 files changed, 177 insertions(+) create mode 100644 test/cxl-mbox.c create mode 100755 test/cxl-mbox.sh diff --git a/test/cxl-mbox.c b/test/cxl-mbox.c new file mode 100644 index 0000000..d81327b --- /dev/null +++ b/test/cxl-mbox.c @@ -0,0 +1,129 @@ +// SPDX-License-Identifier: GPL-2.0 +// Copyright (C) 2026 Nvidia Corporation. All rights reserved. +#include <errno.h> +#include <fcntl.h> +#include <stdio.h> +#include <stdint.h> +#include <stddef.h> +#include <stdlib.h> +#include <syslog.h> +#include <string.h> +#include <unistd.h> +#include <sys/ioctl.h> +#include <cxl/libcxl.h> +#include <cxl/cxl_mem.h> + +static const char provider[] = "cxl_test"; + +/* + * The cxl_test mock advertises a 4 KiB (SZ_4K) mailbox payload_size and + * IDENTIFY returns a full struct cxl_mbox_identify. Post-fix the kernel + * clamps the output allocation to payload_size and copies that many bytes + * back into out.payload, so the buffer must be >= payload_size. 64 KiB is + * comfortably above the mock's 4 KiB payload. + */ +#define OUT_BUF_SIZE (64 * 1024) + +/* + * Regression for the unbounded kvzalloc() in cxl_mbox_cmd_ctor() driven by a + * huge CXL_MEM_SEND_COMMAND out.size. The kernel fix CLAMPS the output + * allocation to the mailbox payload_size; it does not reject the request. + * Assert the ioctl SUCCEEDS (no -ENOMEM) -- do NOT assert -EINVAL. + */ +static int test_cxl_mbox_huge_out_size(struct cxl_memdev *memdev) +{ + struct cxl_send_command c = { 0 }; + const char *devname; + char path[256]; + void *buf; + int fd, rc; + + devname = cxl_memdev_get_devname(memdev); + if (!devname) + return -ENODEV; + + snprintf(path, sizeof(path), "/dev/cxl/%s", devname); + + fd = open(path, O_RDWR); + if (fd < 0) { + if (errno == ENOENT || errno == ENODEV) + return -ENODEV; + fprintf(stderr, "failed to open %s: %s\n", path, + strerror(errno)); + return -errno; + } + + buf = calloc(1, OUT_BUF_SIZE); + if (!buf) { + rc = -ENOMEM; + goto out; + } + + c.id = CXL_MEM_COMMAND_ID_IDENTIFY; + /* + * 0x80000000 (2^31, > INT_MAX) is the proven reproducer that trips the + * size > INT_MAX kvmalloc() WARN. out.size is __s32 in this vendored + * UAPI; cast to avoid -Woverflow, the kernel reads the same 4 bytes + * (kernel UAPI declares it __u32). + */ + c.out.size = (typeof(c.out.size))0x80000000U; + c.out.payload = (__u64)(uintptr_t)buf; + + rc = ioctl(fd, CXL_MEM_SEND_COMMAND, &c); + + /* Pass iff the kernel clamped (success), not rejected. */ + if (rc == 0 && c.retval == 0) { + rc = 0; + goto out; + } + + fprintf(stderr, + "CXL_MEM_SEND_COMMAND huge out.size mishandled: rc=%d errno=%d retval=%u\n", + rc, errno, c.retval); + rc = -ENXIO; + +out: + free(buf); + close(fd); + return rc; +} + +static int test_cxl_mbox(struct cxl_ctx *ctx, struct cxl_bus *bus) +{ + struct cxl_memdev *memdev; + + cxl_memdev_foreach(ctx, memdev) { + if (cxl_memdev_get_bus(memdev) != bus) + continue; + return test_cxl_mbox_huge_out_size(memdev); + } + + return -ENODEV; +} + +int main(int argc, char *argv[]) +{ + struct cxl_ctx *ctx; + struct cxl_bus *bus; + int rc; + + rc = cxl_new(&ctx); + if (rc < 0) + return rc; + + cxl_set_log_priority(ctx, LOG_DEBUG); + + bus = cxl_bus_get_by_provider(ctx, provider); + if (!bus) { + fprintf(stderr, "%s: unable to find bus (%s)\n", + argv[0], provider); + rc = -ENODEV; + goto out; + } + + rc = test_cxl_mbox(ctx, bus); + +out: + cxl_unref(ctx); + return rc; +} diff --git a/test/cxl-mbox.sh b/test/cxl-mbox.sh new file mode 100755 index 0000000..67fecf5 --- /dev/null +++ b/test/cxl-mbox.sh @@ -0,0 +1,48 @@ +#!/bin/bash -Ex +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) 2026 Nvidia Corporation. All rights reserved. + +. $(dirname "$0")/common + +BIN="$TEST_PATH"/cxl-mbox +rc=77 +# 237 is -ENODEV +ERR_NODEV=237 +# TAINT_WARN is bit 9 +TAINT_WARN=512 + +trap 'err $LINENO' ERR + +modprobe -r cxl_test 2>/dev/null +modprobe cxl_test +# cxl_test alone does not autoload the mock memdev module on this box +modprobe cxl_mock_mem + +main() +{ + test -x "$BIN" || do_skip "no CXL mailbox test" + + t0=$(cat /proc/sys/kernel/tainted) + + rc=0 + "$BIN" || rc=$? + + t1=$(cat /proc/sys/kernel/tainted) + + echo "status: $rc" + if [ "$rc" -eq "$ERR_NODEV" ]; then + do_skip "no cxl_test memdev" + elif [ "$rc" -ne 0 ]; then + echo "fail: $LINENO" && exit 1 + fi + + if (( (t1 & TAINT_WARN) && !(t0 & TAINT_WARN) )); then + echo "fail: $LINENO kernel WARN taint (bit 9) set" && exit 1 + fi + + _cxl_cleanup +} + +{ + main "$@"; exit "$?" +} base-commit: 8ad90e54f0ff4f7291e7f21d44d769d10f24e2b6 -- 2.43.0 ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [ndctl PATCH RESEND] test/cxl-mbox: Regression test for huge CXL_MEM_SEND_COMMAND out.size 2026-06-24 15:01 [ndctl PATCH RESEND] test/cxl-mbox: Regression test for huge CXL_MEM_SEND_COMMAND out.size Richard Cheng @ 2026-09-15 0:55 ` Alison Schofield 2026-09-18 9:39 ` Richard Cheng 0 siblings, 1 reply; 3+ messages in thread From: Alison Schofield @ 2026-09-15 0:55 UTC (permalink / raw) To: Richard Cheng Cc: dave, jic23, dave.jiang, vishal.l.verma, djbw, danwilliams, nvdimm, iweiny, ming.li, kobak, kaihengf, kees, newtonl, kristinc, mochs, linux-cxl, linux-kernel On Wed, Jun 24, 2026 at 11:01:58PM +0800, Richard Cheng wrote: > Implement a regression test for unbounded kvzalloc() in the kernel's > cxl_mbox_cmd_ctor(), which a CXL_MEM_SEND_COMMAND with an out.size > greater than INT_MAX could drive into a size > INT_MAX kvmalloc() WARN. > > libcxl's cxl_cmd_set_output_payload() rejects an out.size larger than > the mailbox payload_max, so the test crafts a raw struct > cxl_send_command and issues the CXL_MEM_SEND_COMMAND ioctl directly > against the cxl_test mock memdev. > > The test is for a kernel bug fix [1]. Hi Richard, I appreciate the new test and sorry it got buried in the backlog. I'm appending a diff that I have tested with in my pending branch. If you ACK this diff, then I'll just apply with that. If you want to change anything else, then send a v2. My changes are: - wire the test into the meson environment - update the shell script to be like others, including using check_dmesg intead of reading tainted. - NO changes to your cxl-mbox.c -- Alison diff --git a/test/cxl-mbox.sh b/test/cxl-mbox.sh index 67fecf5a3f46..1b9f95fc7836 100755 --- a/test/cxl-mbox.sh +++ b/test/cxl-mbox.sh @@ -2,33 +2,25 @@ # SPDX-License-Identifier: GPL-2.0 # Copyright (C) 2026 Nvidia Corporation. All rights reserved. -. $(dirname "$0")/common +. "$(dirname "$0")"/common BIN="$TEST_PATH"/cxl-mbox rc=77 # 237 is -ENODEV ERR_NODEV=237 -# TAINT_WARN is bit 9 -TAINT_WARN=512 trap 'err $LINENO' ERR -modprobe -r cxl_test 2>/dev/null +modprobe -r cxl_test modprobe cxl_test -# cxl_test alone does not autoload the mock memdev module on this box -modprobe cxl_mock_mem main() { test -x "$BIN" || do_skip "no CXL mailbox test" - t0=$(cat /proc/sys/kernel/tainted) - rc=0 "$BIN" || rc=$? - t1=$(cat /proc/sys/kernel/tainted) - echo "status: $rc" if [ "$rc" -eq "$ERR_NODEV" ]; then do_skip "no cxl_test memdev" @@ -36,9 +28,8 @@ main() echo "fail: $LINENO" && exit 1 fi - if (( (t1 & TAINT_WARN) && !(t0 & TAINT_WARN) )); then - echo "fail: $LINENO kernel WARN taint (bit 9) set" && exit 1 - fi + rc=1 + check_dmesg "$LINENO" _cxl_cleanup } diff --git a/test/meson.build b/test/meson.build index 07c8618cbc6e..69c22c579b02 100644 --- a/test/meson.build +++ b/test/meson.build @@ -139,6 +139,11 @@ revoke_devmem = executable('revoke_devmem', testcore + [ mmap = executable('mmap', 'mmap.c',) +cxl_mbox = executable('cxl-mbox', 'cxl-mbox.c', + dependencies : libcxl_deps, + include_directories : root_inc, +) + create = find_program('create.sh') clear = find_program('clear.sh') pmem_errors = find_program('pmem-errors.sh') @@ -173,6 +178,7 @@ cxl_elc = find_program('cxl-elc.sh') cxl_dax_hmem = find_program('cxl-dax-hmem.sh') cxl_region_replay = find_program('cxl-region-replay.sh') cxl_type2 = find_program('cxl-type2.sh') +cxl_mbox_sh = find_program('cxl-mbox.sh') tests = [ [ 'libndctl', libndctl, 'ndctl' ], @@ -211,6 +217,7 @@ tests = [ [ 'cxl-dax-hmem.sh', cxl_dax_hmem, 'cxl' ], [ 'cxl-region-replay.sh', cxl_region_replay, 'cxl' ], [ 'cxl-type2.sh', cxl_type2, 'cxl' ], + [ 'cxl-mbox.sh', cxl_mbox_sh, 'cxl' ], ] if get_option('destructive').enabled() @@ -292,6 +299,7 @@ tests_deps = [ daxdev_errors, dax_dev, mmap, + cxl_mbox, ] if get_option('fwctl').enabled() > > [1]: https://lore.kernel.org/all/20260624144147.53997-1-icheng@nvidia.com/ > Signed-off-by: Richard Cheng <icheng@nvidia.com> > --- > test/cxl-mbox.c | 129 +++++++++++++++++++++++++++++++++++++++++++++++ > test/cxl-mbox.sh | 48 ++++++++++++++++++ > 2 files changed, 177 insertions(+) > create mode 100644 test/cxl-mbox.c > create mode 100755 test/cxl-mbox.sh > > diff --git a/test/cxl-mbox.c b/test/cxl-mbox.c > new file mode 100644 > index 0000000..d81327b > --- /dev/null > +++ b/test/cxl-mbox.c > @@ -0,0 +1,129 @@ > +// SPDX-License-Identifier: GPL-2.0 > +// Copyright (C) 2026 Nvidia Corporation. All rights reserved. > +#include <errno.h> > +#include <fcntl.h> > +#include <stdio.h> > +#include <stdint.h> > +#include <stddef.h> > +#include <stdlib.h> > +#include <syslog.h> > +#include <string.h> > +#include <unistd.h> > +#include <sys/ioctl.h> > +#include <cxl/libcxl.h> > +#include <cxl/cxl_mem.h> > + > +static const char provider[] = "cxl_test"; > + > +/* > + * The cxl_test mock advertises a 4 KiB (SZ_4K) mailbox payload_size and > + * IDENTIFY returns a full struct cxl_mbox_identify. Post-fix the kernel > + * clamps the output allocation to payload_size and copies that many bytes > + * back into out.payload, so the buffer must be >= payload_size. 64 KiB is > + * comfortably above the mock's 4 KiB payload. > + */ > +#define OUT_BUF_SIZE (64 * 1024) > + > +/* > + * Regression for the unbounded kvzalloc() in cxl_mbox_cmd_ctor() driven by a > + * huge CXL_MEM_SEND_COMMAND out.size. The kernel fix CLAMPS the output > + * allocation to the mailbox payload_size; it does not reject the request. > + * Assert the ioctl SUCCEEDS (no -ENOMEM) -- do NOT assert -EINVAL. > + */ > +static int test_cxl_mbox_huge_out_size(struct cxl_memdev *memdev) > +{ > + struct cxl_send_command c = { 0 }; > + const char *devname; > + char path[256]; > + void *buf; > + int fd, rc; > + > + devname = cxl_memdev_get_devname(memdev); > + if (!devname) > + return -ENODEV; > + > + snprintf(path, sizeof(path), "/dev/cxl/%s", devname); > + > + fd = open(path, O_RDWR); > + if (fd < 0) { > + if (errno == ENOENT || errno == ENODEV) > + return -ENODEV; > + fprintf(stderr, "failed to open %s: %s\n", path, > + strerror(errno)); > + return -errno; > + } > + > + buf = calloc(1, OUT_BUF_SIZE); > + if (!buf) { > + rc = -ENOMEM; > + goto out; > + } > + > + c.id = CXL_MEM_COMMAND_ID_IDENTIFY; > + /* > + * 0x80000000 (2^31, > INT_MAX) is the proven reproducer that trips the > + * size > INT_MAX kvmalloc() WARN. out.size is __s32 in this vendored > + * UAPI; cast to avoid -Woverflow, the kernel reads the same 4 bytes > + * (kernel UAPI declares it __u32). > + */ > + c.out.size = (typeof(c.out.size))0x80000000U; > + c.out.payload = (__u64)(uintptr_t)buf; > + > + rc = ioctl(fd, CXL_MEM_SEND_COMMAND, &c); > + > + /* Pass iff the kernel clamped (success), not rejected. */ > + if (rc == 0 && c.retval == 0) { > + rc = 0; > + goto out; > + } > + > + fprintf(stderr, > + "CXL_MEM_SEND_COMMAND huge out.size mishandled: rc=%d errno=%d retval=%u\n", > + rc, errno, c.retval); > + rc = -ENXIO; > + > +out: > + free(buf); > + close(fd); > + return rc; > +} > + > +static int test_cxl_mbox(struct cxl_ctx *ctx, struct cxl_bus *bus) > +{ > + struct cxl_memdev *memdev; > + > + cxl_memdev_foreach(ctx, memdev) { > + if (cxl_memdev_get_bus(memdev) != bus) > + continue; > + return test_cxl_mbox_huge_out_size(memdev); > + } > + > + return -ENODEV; > +} > + > +int main(int argc, char *argv[]) > +{ > + struct cxl_ctx *ctx; > + struct cxl_bus *bus; > + int rc; > + > + rc = cxl_new(&ctx); > + if (rc < 0) > + return rc; > + > + cxl_set_log_priority(ctx, LOG_DEBUG); > + > + bus = cxl_bus_get_by_provider(ctx, provider); > + if (!bus) { > + fprintf(stderr, "%s: unable to find bus (%s)\n", > + argv[0], provider); > + rc = -ENODEV; > + goto out; > + } > + > + rc = test_cxl_mbox(ctx, bus); > + > +out: > + cxl_unref(ctx); > + return rc; > +} > diff --git a/test/cxl-mbox.sh b/test/cxl-mbox.sh > new file mode 100755 > index 0000000..67fecf5 > --- /dev/null > +++ b/test/cxl-mbox.sh > @@ -0,0 +1,48 @@ > +#!/bin/bash -Ex > +# SPDX-License-Identifier: GPL-2.0 > +# Copyright (C) 2026 Nvidia Corporation. All rights reserved. > + > +. $(dirname "$0")/common > + > +BIN="$TEST_PATH"/cxl-mbox > +rc=77 > +# 237 is -ENODEV > +ERR_NODEV=237 > +# TAINT_WARN is bit 9 > +TAINT_WARN=512 > + > +trap 'err $LINENO' ERR > + > +modprobe -r cxl_test 2>/dev/null > +modprobe cxl_test > +# cxl_test alone does not autoload the mock memdev module on this box > +modprobe cxl_mock_mem > + > +main() > +{ > + test -x "$BIN" || do_skip "no CXL mailbox test" > + > + t0=$(cat /proc/sys/kernel/tainted) > + > + rc=0 > + "$BIN" || rc=$? > + > + t1=$(cat /proc/sys/kernel/tainted) > + > + echo "status: $rc" > + if [ "$rc" -eq "$ERR_NODEV" ]; then > + do_skip "no cxl_test memdev" > + elif [ "$rc" -ne 0 ]; then > + echo "fail: $LINENO" && exit 1 > + fi > + > + if (( (t1 & TAINT_WARN) && !(t0 & TAINT_WARN) )); then > + echo "fail: $LINENO kernel WARN taint (bit 9) set" && exit 1 > + fi > + > + _cxl_cleanup > +} > + > +{ > + main "$@"; exit "$?" > +} > > base-commit: 8ad90e54f0ff4f7291e7f21d44d769d10f24e2b6 > -- > 2.43.0 > ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [ndctl PATCH RESEND] test/cxl-mbox: Regression test for huge CXL_MEM_SEND_COMMAND out.size 2026-09-15 0:55 ` Alison Schofield @ 2026-09-18 9:39 ` Richard Cheng 0 siblings, 0 replies; 3+ messages in thread From: Richard Cheng @ 2026-09-18 9:39 UTC (permalink / raw) To: Alison Schofield Cc: dave, jic23, dave.jiang, vishal.l.verma, djbw, danwilliams, nvdimm, iweiny, ming.li, kobak, kaihengf, kees, newtonl, kristinc, mochs, linux-cxl, linux-kernel On Mon, Sep 14, 2026 at 05:55:16PM +0800, Alison Schofield wrote: > On Wed, Jun 24, 2026 at 11:01:58PM +0800, Richard Cheng wrote: > > Implement a regression test for unbounded kvzalloc() in the kernel's > > cxl_mbox_cmd_ctor(), which a CXL_MEM_SEND_COMMAND with an out.size > > greater than INT_MAX could drive into a size > INT_MAX kvmalloc() WARN. > > > > libcxl's cxl_cmd_set_output_payload() rejects an out.size larger than > > the mailbox payload_max, so the test crafts a raw struct > > cxl_send_command and issues the CXL_MEM_SEND_COMMAND ioctl directly > > against the cxl_test mock memdev. > > > > The test is for a kernel bug fix [1]. > > Hi Richard, > > I appreciate the new test and sorry it got buried in the backlog. I'm > appending a diff that I have tested with in my pending branch. If you > ACK this diff, then I'll just apply with that. If you want to change > anything else, then send a v2. > Hi Alison, Thanks for taking look at this, from the first glance it looks good to me, but I'll spend some time to review it next week. Best regards, Richard Cheng. > My changes are: > - wire the test into the meson environment > - update the shell script to be like others, including using check_dmesg > intead of reading tainted. > - NO changes to your cxl-mbox.c > > > -- Alison > > > diff --git a/test/cxl-mbox.sh b/test/cxl-mbox.sh > index 67fecf5a3f46..1b9f95fc7836 100755 > --- a/test/cxl-mbox.sh > +++ b/test/cxl-mbox.sh > @@ -2,33 +2,25 @@ > # SPDX-License-Identifier: GPL-2.0 > # Copyright (C) 2026 Nvidia Corporation. All rights reserved. > > -. $(dirname "$0")/common > +. "$(dirname "$0")"/common > > BIN="$TEST_PATH"/cxl-mbox > rc=77 > # 237 is -ENODEV > ERR_NODEV=237 > -# TAINT_WARN is bit 9 > -TAINT_WARN=512 > > trap 'err $LINENO' ERR > > -modprobe -r cxl_test 2>/dev/null > +modprobe -r cxl_test > modprobe cxl_test > -# cxl_test alone does not autoload the mock memdev module on this box > -modprobe cxl_mock_mem > > main() > { > test -x "$BIN" || do_skip "no CXL mailbox test" > > - t0=$(cat /proc/sys/kernel/tainted) > - > rc=0 > "$BIN" || rc=$? > > - t1=$(cat /proc/sys/kernel/tainted) > - > echo "status: $rc" > if [ "$rc" -eq "$ERR_NODEV" ]; then > do_skip "no cxl_test memdev" > @@ -36,9 +28,8 @@ main() > echo "fail: $LINENO" && exit 1 > fi > > - if (( (t1 & TAINT_WARN) && !(t0 & TAINT_WARN) )); then > - echo "fail: $LINENO kernel WARN taint (bit 9) set" && exit 1 > - fi > + rc=1 > + check_dmesg "$LINENO" > > _cxl_cleanup > } > diff --git a/test/meson.build b/test/meson.build > index 07c8618cbc6e..69c22c579b02 100644 > --- a/test/meson.build > +++ b/test/meson.build > @@ -139,6 +139,11 @@ revoke_devmem = executable('revoke_devmem', testcore + [ > > mmap = executable('mmap', 'mmap.c',) > > +cxl_mbox = executable('cxl-mbox', 'cxl-mbox.c', > + dependencies : libcxl_deps, > + include_directories : root_inc, > +) > + > create = find_program('create.sh') > clear = find_program('clear.sh') > pmem_errors = find_program('pmem-errors.sh') > @@ -173,6 +178,7 @@ cxl_elc = find_program('cxl-elc.sh') > cxl_dax_hmem = find_program('cxl-dax-hmem.sh') > cxl_region_replay = find_program('cxl-region-replay.sh') > cxl_type2 = find_program('cxl-type2.sh') > +cxl_mbox_sh = find_program('cxl-mbox.sh') > > tests = [ > [ 'libndctl', libndctl, 'ndctl' ], > @@ -211,6 +217,7 @@ tests = [ > [ 'cxl-dax-hmem.sh', cxl_dax_hmem, 'cxl' ], > [ 'cxl-region-replay.sh', cxl_region_replay, 'cxl' ], > [ 'cxl-type2.sh', cxl_type2, 'cxl' ], > + [ 'cxl-mbox.sh', cxl_mbox_sh, 'cxl' ], > ] > > if get_option('destructive').enabled() > @@ -292,6 +299,7 @@ tests_deps = [ > daxdev_errors, > dax_dev, > mmap, > + cxl_mbox, > ] > > if get_option('fwctl').enabled() > > > > > > [1]: https://lore.kernel.org/all/20260624144147.53997-1-icheng@nvidia.com/ > > Signed-off-by: Richard Cheng <icheng@nvidia.com> > > --- > > test/cxl-mbox.c | 129 +++++++++++++++++++++++++++++++++++++++++++++++ > > test/cxl-mbox.sh | 48 ++++++++++++++++++ > > 2 files changed, 177 insertions(+) > > create mode 100644 test/cxl-mbox.c > > create mode 100755 test/cxl-mbox.sh > > > > diff --git a/test/cxl-mbox.c b/test/cxl-mbox.c > > new file mode 100644 > > index 0000000..d81327b > > --- /dev/null > > +++ b/test/cxl-mbox.c > > @@ -0,0 +1,129 @@ > > +// SPDX-License-Identifier: GPL-2.0 > > +// Copyright (C) 2026 Nvidia Corporation. All rights reserved. > > +#include <errno.h> > > +#include <fcntl.h> > > +#include <stdio.h> > > +#include <stdint.h> > > +#include <stddef.h> > > +#include <stdlib.h> > > +#include <syslog.h> > > +#include <string.h> > > +#include <unistd.h> > > +#include <sys/ioctl.h> > > +#include <cxl/libcxl.h> > > +#include <cxl/cxl_mem.h> > > + > > +static const char provider[] = "cxl_test"; > > + > > +/* > > + * The cxl_test mock advertises a 4 KiB (SZ_4K) mailbox payload_size and > > + * IDENTIFY returns a full struct cxl_mbox_identify. Post-fix the kernel > > + * clamps the output allocation to payload_size and copies that many bytes > > + * back into out.payload, so the buffer must be >= payload_size. 64 KiB is > > + * comfortably above the mock's 4 KiB payload. > > + */ > > +#define OUT_BUF_SIZE (64 * 1024) > > + > > +/* > > + * Regression for the unbounded kvzalloc() in cxl_mbox_cmd_ctor() driven by a > > + * huge CXL_MEM_SEND_COMMAND out.size. The kernel fix CLAMPS the output > > + * allocation to the mailbox payload_size; it does not reject the request. > > + * Assert the ioctl SUCCEEDS (no -ENOMEM) -- do NOT assert -EINVAL. > > + */ > > +static int test_cxl_mbox_huge_out_size(struct cxl_memdev *memdev) > > +{ > > + struct cxl_send_command c = { 0 }; > > + const char *devname; > > + char path[256]; > > + void *buf; > > + int fd, rc; > > + > > + devname = cxl_memdev_get_devname(memdev); > > + if (!devname) > > + return -ENODEV; > > + > > + snprintf(path, sizeof(path), "/dev/cxl/%s", devname); > > + > > + fd = open(path, O_RDWR); > > + if (fd < 0) { > > + if (errno == ENOENT || errno == ENODEV) > > + return -ENODEV; > > + fprintf(stderr, "failed to open %s: %s\n", path, > > + strerror(errno)); > > + return -errno; > > + } > > + > > + buf = calloc(1, OUT_BUF_SIZE); > > + if (!buf) { > > + rc = -ENOMEM; > > + goto out; > > + } > > + > > + c.id = CXL_MEM_COMMAND_ID_IDENTIFY; > > + /* > > + * 0x80000000 (2^31, > INT_MAX) is the proven reproducer that trips the > > + * size > INT_MAX kvmalloc() WARN. out.size is __s32 in this vendored > > + * UAPI; cast to avoid -Woverflow, the kernel reads the same 4 bytes > > + * (kernel UAPI declares it __u32). > > + */ > > + c.out.size = (typeof(c.out.size))0x80000000U; > > + c.out.payload = (__u64)(uintptr_t)buf; > > + > > + rc = ioctl(fd, CXL_MEM_SEND_COMMAND, &c); > > + > > + /* Pass iff the kernel clamped (success), not rejected. */ > > + if (rc == 0 && c.retval == 0) { > > + rc = 0; > > + goto out; > > + } > > + > > + fprintf(stderr, > > + "CXL_MEM_SEND_COMMAND huge out.size mishandled: rc=%d errno=%d retval=%u\n", > > + rc, errno, c.retval); > > + rc = -ENXIO; > > + > > +out: > > + free(buf); > > + close(fd); > > + return rc; > > +} > > + > > +static int test_cxl_mbox(struct cxl_ctx *ctx, struct cxl_bus *bus) > > +{ > > + struct cxl_memdev *memdev; > > + > > + cxl_memdev_foreach(ctx, memdev) { > > + if (cxl_memdev_get_bus(memdev) != bus) > > + continue; > > + return test_cxl_mbox_huge_out_size(memdev); > > + } > > + > > + return -ENODEV; > > +} > > + > > +int main(int argc, char *argv[]) > > +{ > > + struct cxl_ctx *ctx; > > + struct cxl_bus *bus; > > + int rc; > > + > > + rc = cxl_new(&ctx); > > + if (rc < 0) > > + return rc; > > + > > + cxl_set_log_priority(ctx, LOG_DEBUG); > > + > > + bus = cxl_bus_get_by_provider(ctx, provider); > > + if (!bus) { > > + fprintf(stderr, "%s: unable to find bus (%s)\n", > > + argv[0], provider); > > + rc = -ENODEV; > > + goto out; > > + } > > + > > + rc = test_cxl_mbox(ctx, bus); > > + > > +out: > > + cxl_unref(ctx); > > + return rc; > > +} > > diff --git a/test/cxl-mbox.sh b/test/cxl-mbox.sh > > new file mode 100755 > > index 0000000..67fecf5 > > --- /dev/null > > +++ b/test/cxl-mbox.sh > > @@ -0,0 +1,48 @@ > > +#!/bin/bash -Ex > > +# SPDX-License-Identifier: GPL-2.0 > > +# Copyright (C) 2026 Nvidia Corporation. All rights reserved. > > + > > +. $(dirname "$0")/common > > + > > +BIN="$TEST_PATH"/cxl-mbox > > +rc=77 > > +# 237 is -ENODEV > > +ERR_NODEV=237 > > +# TAINT_WARN is bit 9 > > +TAINT_WARN=512 > > + > > +trap 'err $LINENO' ERR > > + > > +modprobe -r cxl_test 2>/dev/null > > +modprobe cxl_test > > +# cxl_test alone does not autoload the mock memdev module on this box > > +modprobe cxl_mock_mem > > + > > +main() > > +{ > > + test -x "$BIN" || do_skip "no CXL mailbox test" > > + > > + t0=$(cat /proc/sys/kernel/tainted) > > + > > + rc=0 > > + "$BIN" || rc=$? > > + > > + t1=$(cat /proc/sys/kernel/tainted) > > + > > + echo "status: $rc" > > + if [ "$rc" -eq "$ERR_NODEV" ]; then > > + do_skip "no cxl_test memdev" > > + elif [ "$rc" -ne 0 ]; then > > + echo "fail: $LINENO" && exit 1 > > + fi > > + > > + if (( (t1 & TAINT_WARN) && !(t0 & TAINT_WARN) )); then > > + echo "fail: $LINENO kernel WARN taint (bit 9) set" && exit 1 > > + fi > > + > > + _cxl_cleanup > > +} > > + > > +{ > > + main "$@"; exit "$?" > > +} > > > > base-commit: 8ad90e54f0ff4f7291e7f21d44d769d10f24e2b6 > > -- > > 2.43.0 > > ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-09-18 9:39 UTC | newest] Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2026-06-24 15:01 [ndctl PATCH RESEND] test/cxl-mbox: Regression test for huge CXL_MEM_SEND_COMMAND out.size Richard Cheng 2026-09-15 0:55 ` Alison Schofield 2026-09-18 9:39 ` Richard Cheng
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®