On Tue, Sep 22, 2026 at 05:01:58PM +0800, Richard Cheng wrote:
> On Mon, Sep 14, 2026 at 05:55:16PM +0800, Alison Schofield wrote:
> > On Wed, Jun 24, 2026 at 11:01:58PM +0800, Richard Cheng wrote:
> > > Implement a regression test for unbounded kvzalloc() in the kernel's
> > > cxl_mbox_cmd_ctor(), which a CXL_MEM_SEND_COMMAND with an out.size
> > > greater than INT_MAX could drive into a size > INT_MAX kvmalloc() WARN.
> > >
> > > libcxl's cxl_cmd_set_output_payload() rejects an out.size larger than
> > > the mailbox payload_max, so the test crafts a raw struct
> > > cxl_send_command and issues the CXL_MEM_SEND_COMMAND ioctl directly
> > > against the cxl_test mock memdev.
> > >
> > > The test is for a kernel bug fix [1].
> >
> > Hi Richard,
> >
> > I appreciate the new test and sorry it got buried in the backlog. I'm
> > appending a diff that I have tested with in my pending branch. If you
> > ACK this diff, then I'll just apply with that. If you want to change
> > anything else, then send a v2.
> >
> > My changes are:
> > - wire the test into the meson environment
> > - update the shell script to be like others, including using check_dmesg
> > intead of reading tainted.
> > - NO changes to your cxl-mbox.c
> >
> >
> > -- Alison
> >
> >
> > diff --git a/test/cxl-mbox.sh b/test/cxl-mbox.sh
> > index 67fecf5a3f46..1b9f95fc7836 100755
> > --- a/test/cxl-mbox.sh
> > +++ b/test/cxl-mbox.sh
> > @@ -2,33 +2,25 @@
> > # SPDX-License-Identifier: GPL-2.0
> > # Copyright (C) 2026 Nvidia Corporation. All rights reserved.
> >
> > -. $(dirname "$0")/common
> > +. "$(dirname "$0")"/common
> >
> > BIN="$TEST_PATH"/cxl-mbox
> > rc=77
> > # 237 is -ENODEV
> > ERR_NODEV=237
> > -# TAINT_WARN is bit 9
> > -TAINT_WARN=512
> >
> > trap 'err $LINENO' ERR
> >
> > -modprobe -r cxl_test 2>/dev/null
> > +modprobe -r cxl_test
> > modprobe cxl_test
> > -# cxl_test alone does not autoload the mock memdev module on this box
> > -modprobe cxl_mock_mem
> >
> > main()
> > {
> > test -x "$BIN" || do_skip "no CXL mailbox test"
> >
> > - t0=$(cat /proc/sys/kernel/tainted)
> > -
> > rc=0
> > "$BIN" || rc=$?
> >
> > - t1=$(cat /proc/sys/kernel/tainted)
> > -
> > echo "status: $rc"
> > if [ "$rc" -eq "$ERR_NODEV" ]; then
> > do_skip "no cxl_test memdev"
> > @@ -36,9 +28,8 @@ main()
> > echo "fail: $LINENO" && exit 1
> > fi
> >
> > - if (( (t1 & TAINT_WARN) && !(t0 & TAINT_WARN) )); then
> > - echo "fail: $LINENO kernel WARN taint (bit 9) set" && exit 1
> > - fi
> > + rc=1
> > + check_dmesg "$LINENO"
> >
> > _cxl_cleanup
> > }
> > diff --git a/test/meson.build b/test/meson.build
> > index 07c8618cbc6e..69c22c579b02 100644
> > --- a/test/meson.build
> > +++ b/test/meson.build
> > @@ -139,6 +139,11 @@ revoke_devmem = executable('revoke_devmem', testcore +
> > [
> >
> > mmap = executable('mmap', 'mmap.c',)
> >
> > +cxl_mbox = executable('cxl-mbox', 'cxl-mbox.c',
> > + dependencies : libcxl_deps,
> > + include_directories : root_inc,
> > +)
> > +
> > create = find_program('create.sh')
> > clear = find_program('clear.sh')
> > pmem_errors = find_program('pmem-errors.sh')
> > @@ -173,6 +178,7 @@ cxl_elc = find_program('cxl-elc.sh')
> > cxl_dax_hmem = find_program('cxl-dax-hmem.sh')
> > cxl_region_replay = find_program('cxl-region-replay.sh')
> > cxl_type2 = find_program('cxl-type2.sh')
> > +cxl_mbox_sh = find_program('cxl-mbox.sh')
> >
> > tests = [
> > [ 'libndctl', libndctl, 'ndctl' ],
> > @@ -211,6 +217,7 @@ tests = [
> > [ 'cxl-dax-hmem.sh', cxl_dax_hmem, 'cxl' ],
> > [ 'cxl-region-replay.sh', cxl_region_replay, 'cxl' ],
> > [ 'cxl-type2.sh', cxl_type2, 'cxl' ],
> > + [ 'cxl-mbox.sh', cxl_mbox_sh, 'cxl' ],
> > ]
> >
> > if get_option('destructive').enabled()
> > @@ -292,6 +299,7 @@ tests_deps = [
> > daxdev_errors,
> > dax_dev,
> > mmap,
> > + cxl_mbox,
> > ]
> >
> > if get_option('fwctl').enabled()
> >
> >
>
> Hi Alison,
>
> Thanks for your kindly review and the modification.
>
> Acked-by: Richard Cheng <[email protected]>
>
> Best regards,
> Richard Cheng.
Applied to pending for NDCTL v86
https://github.com/pmem/ndctl/commit/ef4a5ae264e0
snip
