On Wed, Jun 24, 2026 at 10:00:06PM +0800, Richard Cheng wrote: > Add a negative case to the CXL fwctl test that issues a Get Feature > FWCTL_RPC with out_len == offset(struct fwctl_rpc_cxl_out, payload) and > a non-zero count. The kernel must reject this with -EINVAL instead of > writing the feature payload past the rpc_out buffer. > > This is the userspace regression test for corresponding kernel fix [1].
Hi Richard, I just finished reviewing the now 3 piece series[2], that [1] is now a piece of. One suggestion on top of the kver gating suggested in prior response is to add a companion negative case for the Set Feature bounds fix in the same series. Same shape as this one, ie build a normal Set Feature RPC, set out_len to 0, expect -EINVAL. It's a stronger backstop than the Get case, too because before the fix an out_len of 0 makes kvzalloc() return ZERO_SIZE_PTR, which passes the !rpc_out check, and the header write then oopses rather than just returning a wrong status. Gate it on the same kver helper. I'm stopping short of suggesting a test for the third patch (the Get Feature per-iteration clamp). That one looks like it needs a multi-transfer feature and a device that over returns on the last chunk, neither possible without a cxl_test mock change. -- Alison > [1]: https://lore.kernel.org/all/[email protected]/ [2]: https://lore.kernel.org/linux-cxl/[email protected]/#r > Signed-off-by: Richard Cheng <[email protected]> > --- > test/fwctl.c | 46 ++++++++++++++++++++++++++++++++++++++++++++++ > 1 file changed, 46 insertions(+) > > diff --git a/test/fwctl.c b/test/fwctl.c > index 979c1a6..69d0048 100644 > --- a/test/fwctl.c > +++ b/test/fwctl.c > @@ -5,6 +5,7 @@ > #include <stdio.h> > #include <endian.h> > #include <stdint.h> > +#include <stddef.h> > #include <stdlib.h> > #include <syslog.h> > #include <string.h> > @@ -207,6 +208,45 @@ out: > return rc; > } > > +static int cxl_fwctl_rpc_get_feature_oob(int fd, struct test_feature > *feat_ctx) > +{ > + struct cxl_mbox_get_feat_in *feat_in; > + struct fwctl_rpc_cxl_out *out; > + size_t out_size, in_size; > + struct fwctl_rpc_cxl *in; > + struct fwctl_rpc *rpc; > + int rc; > + > + in_size = sizeof(*in) + sizeof(*feat_in); > + /* header only => zero payload room */ > + out_size = offsetof(struct fwctl_rpc_cxl_out, payload); > + > + rpc = get_prepped_command(in_size, out_size, > + CXL_MBOX_OPCODE_GET_FEATURE); > + if (!rpc) > + return -ENXIO; > + > + in = (struct fwctl_rpc_cxl *)rpc->in; > + out = (struct fwctl_rpc_cxl_out *)rpc->out; > + > + feat_in = &in->get_feat_in; > + uuid_copy(feat_in->uuid, feat_ctx->uuid); > + /* non-zero count that exceeds the zero payload room */ > + feat_in->count = feat_ctx->get_size; > + > + rc = send_command(fd, rpc, out); > + free_rpc(rpc); > + > + if (rc == -EINVAL) > + return 0; > + if (rc == 0) { > + fprintf(stderr, "Get Feature with undersized out_len was not > rejected\n"); > + return -ENXIO; > + } > + fprintf(stderr, "Get Feature OOB rejection test: unexpected rc %d\n", > rc); > + return rc; > +} > + > static int cxl_fwctl_rpc_set_test_feature(int fd, struct test_feature > *feat_ctx) > { > struct cxl_mbox_set_feat_in *feat_in; > @@ -393,6 +433,12 @@ static int test_fwctl_features(struct cxl_memdev *memdev) > goto out; > } > > + rc = cxl_fwctl_rpc_get_feature_oob(fd, &feat_ctx); > + if (rc) { > + fprintf(stderr, "Failed Get Feature OOB rejection test: %d\n", > rc); > + goto out; > + } > + > out: > close(fd); > return rc; > > base-commit: 8ad90e54f0ff4f7291e7f21d44d769d10f24e2b6 > -- > 2.43.0 >
