Re: [PATCH 1/7] KVM: selftests: Account for kernel's off-by-one bug in NUMA node syscalls

[Garg, Shivank]

On Wed, 2026-09-02 at 17:16 -0700, Sean Christopherson wrote:
> Add and use MAXNODE_FOR_MASK() to compute the "correct" maxnode value that
> is passed to various NUMA-related syscalls, e.g. get_mempolicy(), mbind(),
> migrate_pages(), etc.  In quotes, because the kernel has an undocumented,
> longstanding off-by-one bug that requires userspace to specify the number
> of bits plus one, i.e. the max node plus two.
> 
> The kernel bug has been known since 2007[*]:
> 
>  : And this is I think the reason why we can't change this now. I assume
>  : numactl allocates 1024 bits (0 to 1023) and passes 1025 to make sure all
>  : 1024 bits are processed. If we change it now, kernel will process 1025
>  : bits (0 to 1024) and overflow the allocated bitmask. If it happens to be
>  : at the border of mmaped vma, it's a segfault...
> 
> But unfortunately the manpages haven't yet been updated, e.g.
> 
>  : The maxnode argument is the maximum node number in the bit mask plus one
> 
> Link: https://lore.kernel.org/all/63ccc890-fd57-118b-5997-e0259f507d28@xxxxxxx[*]
> Signed-off-by: Sean Christopherson <seanjc@xxxxxxxxxx>
> ---
>  tools/testing/selftests/kvm/guest_memfd_test.c   |  2 +-
>  tools/testing/selftests/kvm/include/numaif.h     | 11 +++++++++++
>  tools/testing/selftests/kvm/x86/xapic_ipi_test.c |  2 +-
>  3 files changed, 13 insertions(+), 2 deletions(-)
> 
> diff --git a/tools/testing/selftests/kvm/guest_memfd_test.c b/tools/testing/selftests/kvm/guest_memfd_test.c
> index 2233d871a38f..cd5df88bc642 100644
> --- a/tools/testing/selftests/kvm/guest_memfd_test.c
> +++ b/tools/testing/selftests/kvm/guest_memfd_test.c
> @@ -80,7 +80,7 @@ static void test_mbind(int fd, size_t total_size)
>  {
>  	const unsigned long nodemask_0 = 1; /* nid: 0 */
>  	unsigned long nodemask = 0;
> -	unsigned long maxnode = BITS_PER_TYPE(nodemask);
> +	unsigned long maxnode = MAXNODE_FOR_MASK(nodemask);
>  	int policy;
>  	char *mem;
>  	int ret;
> diff --git a/tools/testing/selftests/kvm/include/numaif.h b/tools/testing/selftests/kvm/include/numaif.h
> index 29572a6d789c..71f261eafc90 100644
> --- a/tools/testing/selftests/kvm/include/numaif.h
> +++ b/tools/testing/selftests/kvm/include/numaif.h
> @@ -6,6 +6,7 @@
>  
>  #include <dirent.h>
>  
> +#include <linux/bitops.h>
>  #include <linux/mempolicy.h>
>  
>  #include "kvm_syscalls.h"
> @@ -30,6 +31,16 @@ KVM_SYSCALL_DEFINE(mbind, 6, void *, addr, unsigned long, size, int, mode,
>  		   const unsigned long *, nodemask, unsigned long, maxnode,
>  		   unsigned int, flags);
>  
> +/*
> + * Calculate the @maxnode param for the above syscalls given the mask that will
> + * be passed to the kernel, to account for a longstanding off-by-one bug in the
> + * kernel that isn't properly documented in the manpages.  The manpages say
> + * that @maxnode is "the maximum node ID plus one", but the kernel's actual
> + * behavior is "the number of bits in the mask plus one", i.e. "the maximum
> + * node ID plus two".
> + */
> +#define MAXNODE_FOR_MASK(mask) (BITS_PER_TYPE(mask) + 1)
> +
>  static inline int get_max_numa_node(void)
>  {
>  	struct dirent *de;
> diff --git a/tools/testing/selftests/kvm/x86/xapic_ipi_test.c b/tools/testing/selftests/kvm/x86/xapic_ipi_test.c
> index 469e3ab16460..1ddcf95d7fe4 100644
> --- a/tools/testing/selftests/kvm/x86/xapic_ipi_test.c
> +++ b/tools/testing/selftests/kvm/x86/xapic_ipi_test.c
> @@ -248,7 +248,7 @@ void do_migrations(struct test_data_page *data, int run_secs, int delay_usecs,
>  		delay_usecs);
>  
>  	/* Get set of first 64 numa nodes available */
> -	kvm_get_mempolicy(NULL, &nodemask, sizeof(nodemask) * 8,
> +	kvm_get_mempolicy(NULL, &nodemask, MAXNODE_FOR_MASK(nodemask),
>  			  0, MPOL_F_MEMS_ALLOWED);
>  
>  	fprintf(stderr, "Numa nodes found amongst first %lu possible nodes "

LGTM!

Reviewed-by: Shivank Garg <shivankg@xxxxxxx>


Thanks,
Shivank