Re: [PATCH v3 2/3] cxl/features: Reject Set Features output buffer smaller than the header

On Fri, Jun 26, 2026 at 06:41:01PM +0800, Richard Cheng wrote:
> cxlctl_set_feature() sizes its output buffer from the user's
> fwctl_rpc.out_len but never checks it is large enough to hold even the
> fwctl_rpc_cxl_out header. With out_len == 0 , kvzalloc() returns
> ZERO_SIZE_PTR, which passes the !rpc_out check, the subsequent
> rpc_out->size = 0 then writes through the poison pointer.
> 
> Reject requests whose output buffer can't hold the response header,
> before allocating. The Set Feature reply carries no payload, so the
> header is all that is required.

See my message on the ndctl PATCH wrt adding a test case for this one.

Reviewed-by: Alison Schofield <[email protected]>