[LTP] [PATCH v3 0/3] mmap testing suite to cover MAP_32BIT

[LTP] [PATCH v3 0/3] mmap testing suite to cover MAP_32BIT

[Andrea Cervesato]

Create two new tests to verify MAP_32BIT functionality:

- mmap23: verify if it fails with invalid parameters
- mmap24: verify bondaries of the allocation

Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
Changes in v3:
- switch to PROT_NONE and drop memory writes to avoid physical allocation and commit limits
- add unrestricted control mmap() on ENOMEM to detect generic memory exhaustion
- fix format warnings on 32-bit builds by replacing %zu with %lu
- use TESTPTR macro instead of bare mmap() calls

Changes in v2:
- fix description
- Link to v1: https://lore.kernel.org/20260828-mmap_32bit_coverage-v1-0-7f0b8b589773@suse.com

---
Andrea Cervesato (3):
      lapi/mmap: add MAP_32BIT fallback
      mmap23: add test for MAP_32BIT oversized mapping
      mmap24: add test for MAP_32BIT address limit

 include/lapi/mmap.h                       |   4 ++
 runtest/syscalls                          |   2 +
 testcases/kernel/syscalls/mmap/.gitignore |   2 +
 testcases/kernel/syscalls/mmap/mmap23.c   |  36 ++++++++++
 testcases/kernel/syscalls/mmap/mmap24.c   | 112 ++++++++++++++++++++++++++++++
 5 files changed, 156 insertions(+)
---
base-commit: f6933a16f304f36045ec39300c6496dae452933d
change-id: 20260827-mmap_32bit_coverage-09a22407aa39

Best regards,
--  
Andrea Cervesato <andrea.cervesato@suse.com>


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v3 1/3] lapi/mmap: add MAP_32BIT fallback

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

Reviewed-by: Petr Vorel <pvorel@suse.cz>
Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 include/lapi/mmap.h | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/include/lapi/mmap.h b/include/lapi/mmap.h
index 3908310f4..f20eb3bd5 100644
--- a/include/lapi/mmap.h
+++ b/include/lapi/mmap.h
@@ -91,6 +91,10 @@
 # define MAP_DROPPABLE 0x08
 #endif
 
+#ifndef MAP_32BIT
+# define MAP_32BIT 0x40
+#endif
+
 #ifndef MREMAP_DONTUNMAP
 # define MREMAP_DONTUNMAP 4
 #endif

-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] lapi/mmap: add MAP_32BIT fallback

[linuxtestproject.agent]

Hi Andrea,

On Fri Sep 11 17:29:53 2026 +0200, Andrea Cervesato wrote:
> lapi/mmap: add MAP_32BIT fallback

Verdict - Reviewed

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH v3 1/3] lapi/mmap: add MAP_32BIT fallback

[Li Wang]

Reviewed-by: Li Wang <li.wang@linux.dev>

-- 
Regards,
Li Wang

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v3 2/3] mmap23: add test for MAP_32BIT oversized mapping

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

Add a test verifying that mmap() with the MAP_32BIT flag fails
with ENOMEM when requesting a mapping of size >= 2GB, since it
cannot fit within the first 2GB of address space.

Reviewed-by: Petr Vorel <pvorel@suse.cz>
Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 runtest/syscalls                          |  1 +
 testcases/kernel/syscalls/mmap/.gitignore |  1 +
 testcases/kernel/syscalls/mmap/mmap23.c   | 36 +++++++++++++++++++++++++++++++
 3 files changed, 38 insertions(+)

diff --git a/runtest/syscalls b/runtest/syscalls
index ca190dd97..56f88c0b6 100644
--- a/runtest/syscalls
+++ b/runtest/syscalls
@@ -890,6 +890,7 @@ mmap20 mmap20
 mmap21_01 mmap21 -m 1
 mmap21_02 mmap21
 mmap22 mmap22
+mmap23 mmap23
 
 modify_ldt01 modify_ldt01
 modify_ldt02 modify_ldt02
diff --git a/testcases/kernel/syscalls/mmap/.gitignore b/testcases/kernel/syscalls/mmap/.gitignore
index 075be933d..dd332e9a1 100644
--- a/testcases/kernel/syscalls/mmap/.gitignore
+++ b/testcases/kernel/syscalls/mmap/.gitignore
@@ -19,3 +19,4 @@
 /mmap20
 /mmap21
 /mmap22
+/mmap23
diff --git a/testcases/kernel/syscalls/mmap/mmap23.c b/testcases/kernel/syscalls/mmap/mmap23.c
new file mode 100644
index 000000000..4eb7bf6e9
--- /dev/null
+++ b/testcases/kernel/syscalls/mmap/mmap23.c
@@ -0,0 +1,36 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (C) 2026 SUSE LLC Andrea Cervesato <andrea.cervesato@suse.com>
+ */
+
+/*\
+ * Verify that :manpage:`mmap(2)` with the MAP_32BIT flag fails with ENOMEM
+ * when requesting a mapping of size >= 2GB, since it cannot fit within the
+ * first 2GB of address space.
+ *
+ * MAP_32BIT is supported only on x86-64 for 64-bit programs.
+ */
+
+#include "tst_test.h"
+#include "lapi/mmap.h"
+
+#define MAP_SZ (2UL * TST_GB)
+
+static void run(void)
+{
+	TST_EXP_FAIL_PTR_VOID(mmap(NULL, MAP_SZ, PROT_READ | PROT_WRITE,
+				   MAP_PRIVATE | MAP_ANONYMOUS | MAP_32BIT, -1, 0),
+			      ENOMEM,
+			      "mmap(2GB) with MAP_32BIT");
+
+	if (TST_RET_PTR != MAP_FAILED)
+		SAFE_MUNMAP(TST_RET_PTR, MAP_SZ);
+}
+
+static struct tst_test test = {
+	.test_all = run,
+	.supported_archs = (const char *const []){
+		"x86_64",
+		NULL
+	},
+};

-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH v3 2/3] mmap23: add test for MAP_32BIT oversized mapping

[Li Wang]

Reviewed-by: Li Wang <li.wang@linux.dev>

-- 
Regards,
Li Wang

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v3 3/3] mmap24: add test for MAP_32BIT address limit

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

Add a test verifying that mmap() with the MAP_32BIT flag restricts
mappings to the first 2GB of address space and fails with ENOMEM
when the 32-bit address space is exhausted without falling back to
higher addresses.

Reviewed-by: Cyril Hrubis <chrubis@suse.cz>
Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 runtest/syscalls                          |   1 +
 testcases/kernel/syscalls/mmap/.gitignore |   1 +
 testcases/kernel/syscalls/mmap/mmap24.c   | 112 ++++++++++++++++++++++++++++++
 3 files changed, 114 insertions(+)

diff --git a/runtest/syscalls b/runtest/syscalls
index 56f88c0b6..418e8f64d 100644
--- a/runtest/syscalls
+++ b/runtest/syscalls
@@ -891,6 +891,7 @@ mmap21_01 mmap21 -m 1
 mmap21_02 mmap21
 mmap22 mmap22
 mmap23 mmap23
+mmap24 mmap24
 
 modify_ldt01 modify_ldt01
 modify_ldt02 modify_ldt02
diff --git a/testcases/kernel/syscalls/mmap/.gitignore b/testcases/kernel/syscalls/mmap/.gitignore
index dd332e9a1..f072e7f64 100644
--- a/testcases/kernel/syscalls/mmap/.gitignore
+++ b/testcases/kernel/syscalls/mmap/.gitignore
@@ -20,3 +20,4 @@
 /mmap21
 /mmap22
 /mmap23
+/mmap24
diff --git a/testcases/kernel/syscalls/mmap/mmap24.c b/testcases/kernel/syscalls/mmap/mmap24.c
new file mode 100644
index 000000000..2152036a4
--- /dev/null
+++ b/testcases/kernel/syscalls/mmap/mmap24.c
@@ -0,0 +1,112 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (C) 2026 SUSE LLC Andrea Cervesato <andrea.cervesato@suse.com>
+ */
+
+/*\
+ * Verify that :manpage:`mmap(2)` with the MAP_32BIT flag restricts all mappings
+ * to the first 2GB of the process address space (< 0x80000000).
+ *
+ * MAP_32BIT is supported only on x86-64 for 64-bit programs.
+ *
+ * Use PROT_NONE to test address placement without allocating data pages
+ * or charging private writable memory against the commit limit.
+ *
+ * [Algorithm]
+ *
+ * - Repeatedly reserve 32MB chunks with MAP_32BIT and PROT_NONE until ENOMEM
+ * - Verify that every returned address satisfies (addr + size) <= 0x80000000
+ * - Verify that at least one chunk was mapped and failure errno is ENOMEM
+ * - Before releasing any chunks, try the same mapping without MAP_32BIT
+ * - Report TCONF if the unrestricted mapping also fails with ENOMEM,
+ *   otherwise verify that it succeeds
+ * - Unmap all allocated chunks in cleanup
+ */
+
+#include "tst_test.h"
+#include "lapi/mmap.h"
+
+#define ADDR_LIMIT 0x80000000UL
+#define CHUNK_SZ (32UL * TST_MB)
+#define MAX_CHUNKS 64
+
+static void *addrs[MAX_CHUNKS];
+static size_t num_chunks;
+
+static void cleanup(void)
+{
+	size_t i;
+
+	for (i = 0; i < num_chunks; i++) {
+		if (addrs[i]) {
+			SAFE_MUNMAP(addrs[i], CHUNK_SZ);
+			addrs[i] = NULL;
+		}
+	}
+	num_chunks = 0;
+}
+
+static void run(void)
+{
+	size_t i;
+	void *addr;
+
+	for (i = 0; i < MAX_CHUNKS; i++) {
+		TESTPTR(mmap(NULL, CHUNK_SZ, PROT_NONE,
+			     MAP_PRIVATE | MAP_ANONYMOUS | MAP_32BIT, -1, 0));
+		addr = TST_RET_PTR;
+
+		if (addr == MAP_FAILED) {
+			if (TST_ERR != ENOMEM) {
+				tst_res(TFAIL | TTERRNO,
+					"mmap() failed with unexpected errno");
+				goto out;
+			}
+			break;
+		}
+
+		addrs[num_chunks++] = addr;
+
+		if ((unsigned long)addr + CHUNK_SZ > ADDR_LIMIT) {
+			tst_res(TFAIL, "mapping at %p + %lu exceeds 2GB limit",
+				addr, CHUNK_SZ);
+			goto out;
+		}
+	}
+
+	if (i == MAX_CHUNKS) {
+		tst_res(TFAIL, "MAP_32BIT did not fail with ENOMEM");
+		goto out;
+	}
+
+	/* Keep the chunks mapped so the control sees the same resource usage. */
+	TESTPTR(mmap(NULL, CHUNK_SZ, PROT_NONE,
+		     MAP_PRIVATE | MAP_ANONYMOUS, -1, 0));
+	if (TST_RET_PTR == MAP_FAILED) {
+		if (TST_ERR == ENOMEM)
+			tst_brk(TCONF | TTERRNO,
+				"Unrestricted mmap() also failed; result inconclusive");
+		tst_brk(TBROK | TTERRNO,
+			"Unrestricted mmap() failed unexpectedly");
+	}
+	SAFE_MUNMAP(TST_RET_PTR, CHUNK_SZ);
+
+	if (!num_chunks)
+		tst_res(TFAIL, "failed to map any chunk with MAP_32BIT");
+	else
+		tst_res(TPASS,
+			"Mapped %lu MB across %zu chunks within 2GB before ENOMEM",
+			(num_chunks * CHUNK_SZ) / TST_MB, num_chunks);
+
+out:
+	cleanup();
+}
+
+static struct tst_test test = {
+	.cleanup = cleanup,
+	.test_all = run,
+	.supported_archs = (const char *const []){
+		"x86_64",
+		NULL
+	},
+};

-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH v3 3/3] mmap24: add test for MAP_32BIT address limit

[Li Wang]

> +/*\
> + * Verify that :manpage:`mmap(2)` with the MAP_32BIT flag restricts all mappings
> + * to the first 2GB of the process address space (< 0x80000000).
> + *
> + * MAP_32BIT is supported only on x86-64 for 64-bit programs.
> + *
> + * Use PROT_NONE to test address placement without allocating data pages
> + * or charging private writable memory against the commit limit.

Reviewed-by: Li Wang <li.wang@linux.dev>

This test itself looks good, but unlike the address placement way, maybe we
can create a new test (mmap25.c) that allocates real read-write anonymous memory,
writes a pattern, reads it back, and checks the result.

This verifies that read-write memory mapped with MAP_32BIT functions correctly.

-- 
Regards,
Li Wang

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH 1/3] lapi/mmap: add MAP_32BIT fallback

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 include/lapi/mmap.h | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/include/lapi/mmap.h b/include/lapi/mmap.h
index 3908310f4..f20eb3bd5 100644
--- a/include/lapi/mmap.h
+++ b/include/lapi/mmap.h
@@ -91,6 +91,10 @@
 # define MAP_DROPPABLE 0x08
 #endif
 
+#ifndef MAP_32BIT
+# define MAP_32BIT 0x40
+#endif
+
 #ifndef MREMAP_DONTUNMAP
 # define MREMAP_DONTUNMAP 4
 #endif

-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] lapi/mmap: add MAP_32BIT fallback

[linuxtestproject.agent]

Hi Andrea,

On Aug 28, 2026, Andrea Cervesato wrote:
> lapi/mmap: add MAP_32BIT fallback

--- [PATCH 3/3] ---

>  * - Verify that memory in each chunk is readable and writable
> [...]
> 		((char *)addr)[0] = 'a';
> 		((char *)addr)[CHUNK_SZ - 1] = 'z';

The algorithm says that each chunk is verified to be both readable and
writable, but these statements only write to the mapping. Could the test
read and compare the stored bytes, or should the readability claim be
removed?

Verdict - Needs revision

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] lapi/mmap: add MAP_32BIT fallback

[Andrea Cervesato via ltp]

> On Aug 28, 2026, Andrea Cervesato wrote:
> > lapi/mmap: add MAP_32BIT fallback
> 
> --- [PATCH 3/3] ---
> 
> >  * - Verify that memory in each chunk is readable and writable
> > [...]
> > 		((char *)addr)[0] = 'a';
> > 		((char *)addr)[CHUNK_SZ - 1] = 'z';
> 
> The algorithm says that each chunk is verified to be both readable and
> writable, but these statements only write to the mapping. Could the test
> read and compare the stored bytes, or should the readability claim be
> removed?

this simply requires:

* - Touch first and last byte of each chunk to ensure pages are writable

will add before merge.

--
Andrea Cervesato
SUSE QE Automation Engineer Linux
andrea.cervesato@suse.com

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp