Re: [ndctl PATCH RESEND] test/cxl-mbox: Regression test for huge CXL_MEM_SEND_COMMAND out.size

[Alison Schofield <alison.schofield@intel.com>]

On Tue, Sep 22, 2026 at 05:01:58PM +0800, Richard Cheng wrote:
> On Mon, Sep 14, 2026 at 05:55:16PM +0800, Alison Schofield wrote:
> > On Wed, Jun 24, 2026 at 11:01:58PM +0800, Richard Cheng wrote:
> > > Implement a regression test for unbounded kvzalloc() in the kernel's
> > > cxl_mbox_cmd_ctor(), which a CXL_MEM_SEND_COMMAND with an out.size
> > > greater than INT_MAX could drive into a size > INT_MAX kvmalloc() WARN.
> > > 
> > > libcxl's cxl_cmd_set_output_payload() rejects an out.size larger than
> > > the mailbox payload_max, so the test crafts a raw struct
> > > cxl_send_command and issues the CXL_MEM_SEND_COMMAND ioctl directly
> > > against the cxl_test mock memdev.
> > > 
> > > The test is for a kernel bug fix [1].
> > 
> > Hi Richard,
> > 
> > I appreciate the new test and sorry it got buried in the backlog. I'm
> > appending a diff that I have tested with in my pending branch. If you
> > ACK this diff, then I'll just apply with that. If you want to change
> > anything else, then send a v2.
> > 
> > My changes are:
> > - wire the test into the meson environment
> > - update the shell script to be like others, including using check_dmesg
> >   intead of reading tainted.
> > - NO changes to your cxl-mbox.c
> > 
> > 
> > -- Alison
> > 
> > 
> > diff --git a/test/cxl-mbox.sh b/test/cxl-mbox.sh
> > index 67fecf5a3f46..1b9f95fc7836 100755
> > --- a/test/cxl-mbox.sh
> > +++ b/test/cxl-mbox.sh
> > @@ -2,33 +2,25 @@
> >  # SPDX-License-Identifier: GPL-2.0
> >  # Copyright (C) 2026 Nvidia Corporation. All rights reserved.
> > 
> > -. $(dirname "$0")/common
> > +. "$(dirname "$0")"/common
> > 
> >  BIN="$TEST_PATH"/cxl-mbox
> >  rc=77
> >  # 237 is -ENODEV
> >  ERR_NODEV=237
> > -# TAINT_WARN is bit 9
> > -TAINT_WARN=512
> > 
> >  trap 'err $LINENO' ERR
> > 
> > -modprobe -r cxl_test 2>/dev/null
> > +modprobe -r cxl_test
> >  modprobe cxl_test
> > -# cxl_test alone does not autoload the mock memdev module on this box
> > -modprobe cxl_mock_mem
> > 
> >  main()
> >  {
> >         test -x "$BIN" || do_skip "no CXL mailbox test"
> > 
> > -       t0=$(cat /proc/sys/kernel/tainted)
> > -
> >         rc=0
> >         "$BIN" || rc=$?
> > 
> > -       t1=$(cat /proc/sys/kernel/tainted)
> > -
> >         echo "status: $rc"
> >         if [ "$rc" -eq "$ERR_NODEV" ]; then
> >                 do_skip "no cxl_test memdev"
> > @@ -36,9 +28,8 @@ main()
> >                 echo "fail: $LINENO" && exit 1
> >         fi
> > 
> > -       if (( (t1 & TAINT_WARN) && !(t0 & TAINT_WARN) )); then
> > -               echo "fail: $LINENO kernel WARN taint (bit 9) set" && exit 1
> > -       fi
> > +       rc=1
> > +       check_dmesg "$LINENO"
> > 
> >         _cxl_cleanup
> >  }
> > diff --git a/test/meson.build b/test/meson.build
> > index 07c8618cbc6e..69c22c579b02 100644
> > --- a/test/meson.build
> > +++ b/test/meson.build
> > @@ -139,6 +139,11 @@ revoke_devmem = executable('revoke_devmem', testcore + [
> > 
> >  mmap = executable('mmap', 'mmap.c',)
> > 
> > +cxl_mbox = executable('cxl-mbox', 'cxl-mbox.c',
> > +  dependencies : libcxl_deps,
> > +  include_directories : root_inc,
> > +)
> > +
> >  create = find_program('create.sh')
> >  clear = find_program('clear.sh')
> >  pmem_errors = find_program('pmem-errors.sh')
> > @@ -173,6 +178,7 @@ cxl_elc = find_program('cxl-elc.sh')
> >  cxl_dax_hmem = find_program('cxl-dax-hmem.sh')
> >  cxl_region_replay = find_program('cxl-region-replay.sh')
> >  cxl_type2 = find_program('cxl-type2.sh')
> > +cxl_mbox_sh = find_program('cxl-mbox.sh')
> > 
> >  tests = [
> >    [ 'libndctl',               libndctl,                  'ndctl' ],
> > @@ -211,6 +217,7 @@ tests = [
> >    [ 'cxl-dax-hmem.sh',        cxl_dax_hmem,       'cxl'   ],
> >    [ 'cxl-region-replay.sh',   cxl_region_replay,  'cxl'   ],
> >    [ 'cxl-type2.sh',           cxl_type2,          'cxl'   ],
> > +  [ 'cxl-mbox.sh',            cxl_mbox_sh,        'cxl'   ],
> >  ]
> > 
> >  if get_option('destructive').enabled()
> > @@ -292,6 +299,7 @@ tests_deps = [
> >    daxdev_errors,
> >    dax_dev,
> >    mmap,
> > +  cxl_mbox,
> >  ]
> > 
> >  if get_option('fwctl').enabled()
> > 
> >
> 
> Hi Alison,
> 
> Thanks for your kindly review and the modification.
> 
> Acked-by: Richard Cheng <icheng@nvidia.com>
> 
> Best regards,
> Richard Cheng.

Applied to pending for NDCTL v86
https://github.com/pmem/ndctl/commit/ef4a5ae264e0

snip