[LTP] Suggested fix for the mremap03 syscall testcase

[LTP] Suggested fix for the mremap03 syscall testcase

[Martin Cermak via ltp]

[-- Attachment #1: Type: text/plain, Size: 1579 bytes --]

Hello folks,

I suspect that LTP commit 88cfde5fbc14b23f673b81855127448a519679c0
introduced a regression it the mremap03 testcase.  I've originally
reported it as a Valgrind bug:

https://bugs.kde.org/show_bug.cgi?id=526974

But now I think it's an LTP bug.  Proposed fix:

$ cat 0001-Fix-the-mremap03-syscall-testcase.patch
From 3ddcfa8c303feeb8681632e458d71001fbfb825c Mon Sep 17 00:00:00 2001
From: Martin Cermak <mcermak@redhat.com>
Date: Wed, 14 Oct 2026 14:07:45 +0200
Subject: [PATCH] Fix the mremap03 syscall testcase

Commit 88cfde5fbc14b23f673b81855127448a519679c0 introduced a regression
in the setup() function of the mremap03 testcase.  The goal is to pass
a bad_addr to the mremap() syscall.

The original version of the setup() function did generate the bad_addr
using tst_get_bad_addr().  This gives a mapped address which is not
accessible (PROT_NONE).  The new version of the test does the same, but
unmaps that address right after that.  Valgrind flags that as an error.

This patch restores the original behavior of the setup() funcrion.
---
 testcases/kernel/syscalls/mremap/mremap03.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/testcases/kernel/syscalls/mremap/mremap03.c b/testcases/kernel/syscalls/mremap/mremap03.c
index 4e647cdca..6003657d4 100644
--- a/testcases/kernel/syscalls/mremap/mremap03.c
+++ b/testcases/kernel/syscalls/mremap/mremap03.c
@@ -35,7 +35,6 @@ static void setup(void)
 	newsize = 2 * memsize;

 	bad_addr = tst_get_bad_addr(NULL);
-	SAFE_MUNMAP(bad_addr, page_size);
 }

 static void run(void)
--
2.55.0

$

Thanks,
Martin

[-- Attachment #2: 0001-Fix-the-mremap03-syscall-testcase.patch --]
[-- Type: text/plain, Size: 1239 bytes --]

From 3ddcfa8c303feeb8681632e458d71001fbfb825c Mon Sep 17 00:00:00 2001
From: Martin Cermak <mcermak@redhat.com>
Date: Wed, 14 Oct 2026 14:07:45 +0200
Subject: [PATCH] Fix the mremap03 syscall testcase

Commit 88cfde5fbc14b23f673b81855127448a519679c0 introduced a regression
in the setup() function of the mremap03 testcase.  The goal is to pass
a bad_addr to the mremap() syscall.

The original version of the setup() function did generate the bad_addr
using tst_get_bad_addr().  This gives a mapped address which is not
accessible (PROT_NONE).  The new version of the test does the same, but
unmaps that address right after that.  Valgrind flags that as an error.

This patch restores the original behavior of the setup() funcrion.
---
 testcases/kernel/syscalls/mremap/mremap03.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/testcases/kernel/syscalls/mremap/mremap03.c b/testcases/kernel/syscalls/mremap/mremap03.c
index 4e647cdca..6003657d4 100644
--- a/testcases/kernel/syscalls/mremap/mremap03.c
+++ b/testcases/kernel/syscalls/mremap/mremap03.c
@@ -35,7 +35,6 @@ static void setup(void)
 	newsize = 2 * memsize;
 
 	bad_addr = tst_get_bad_addr(NULL);
-	SAFE_MUNMAP(bad_addr, page_size);
 }
 
 static void run(void)
-- 
2.55.0


[-- Attachment #3: Type: text/plain, Size: 60 bytes --]


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] Fix the mremap03 syscall testcase

[linuxtestproject.agent]

Hi Martin,

On Wed, 14 Oct 2026, Martin Cermak wrote:
> Fix the mremap03 syscall testcase

> diff --git a/testcases/kernel/syscalls/mremap/mremap03.c b/testcases/kernel/syscalls/mremap/mremap03.c
> @@ -35,7 +35,6 @@ static void setup(void)
>  	bad_addr = tst_get_bad_addr(NULL);
> -	SAFE_MUNMAP(bad_addr, page_size);

tst_get_bad_addr() returns a mapped PROT_NONE page, which mremap() can
resize; deleting this line drops the documented unmapped-old_address case.
The test still passes because old_size is 1000 pages and extends beyond
that VMA, exercising a different EFAULT check. Keep SAFE_MUNMAP() here to
preserve coverage of an unmapped old_address.

> This patch restores the original behavior of the setup() funcrion.

The commit message is missing the required Signed-off-by: trailer.
Add it at the end of the message.

Verdict - Needs revision

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] Suggested fix for the mremap03 syscall testcase

[Andrea Cervesato via ltp]

Hi Martin,

you are right. That’s a bug we didn’t spot during the test rewrite. Thanks.

Reviewed-by: Andrea Cervesato <andrea.cervesato@suse.com>

> On 14. Oct 2026, at 14:20, Martin Cermak via ltp <ltp@lists.linux.it> wrote:
> 
> Hello folks,
> 
> I suspect that LTP commit 88cfde5fbc14b23f673b81855127448a519679c0
> introduced a regression it the mremap03 testcase.  I've originally
> reported it as a Valgrind bug:
> 
> https://bugs.kde.org/show_bug.cgi?id=526974
> 
> But now I think it's an LTP bug.  Proposed fix:
> 
> $ cat 0001-Fix-the-mremap03-syscall-testcase.patch
> From 3ddcfa8c303feeb8681632e458d71001fbfb825c Mon Sep 17 00:00:00 2001
> From: Martin Cermak <mcermak@redhat.com>
> Date: Wed, 14 Oct 2026 14:07:45 +0200
> Subject: [PATCH] Fix the mremap03 syscall testcase
> 
> Commit 88cfde5fbc14b23f673b81855127448a519679c0 introduced a regression
> in the setup() function of the mremap03 testcase.  The goal is to pass
> a bad_addr to the mremap() syscall.
> 
> The original version of the setup() function did generate the bad_addr
> using tst_get_bad_addr().  This gives a mapped address which is not
> accessible (PROT_NONE).  The new version of the test does the same, but
> unmaps that address right after that.  Valgrind flags that as an error.
> 
> This patch restores the original behavior of the setup() funcrion.
> ---
> testcases/kernel/syscalls/mremap/mremap03.c | 1 -
> 1 file changed, 1 deletion(-)
> 
> diff --git a/testcases/kernel/syscalls/mremap/mremap03.c b/testcases/kernel/syscalls/mremap/mremap03.c
> index 4e647cdca..6003657d4 100644
> --- a/testcases/kernel/syscalls/mremap/mremap03.c
> +++ b/testcases/kernel/syscalls/mremap/mremap03.c
> @@ -35,7 +35,6 @@ static void setup(void)
>    newsize = 2 * memsize;
> 
>    bad_addr = tst_get_bad_addr(NULL);
> -    SAFE_MUNMAP(bad_addr, page_size);
> }
> 
> static void run(void)
> --
> 2.55.0
> 
> $
> 
> Thanks,
> Martin
> <0001-Fix-the-mremap03-syscall-testcase.patch>
> 
> -- 
> Mailing list info: https://lists.linux.it/listinfo/ltp

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [Valgrind-developers] Suggested fix for the mremap03 syscall testcase

[Petr Vorel]

Hi Martin, Andrea, 

> Hi Martin,

> you are right. That’s a bug we didn’t spot during the test rewrite. Thanks.

Good catch, Martin, you're of course right => turned into proper patch and
merged.

valgrind ./mremap03
tst_test.c:1895: TINFO: Overall timeout per run is 0h 00m 30s
--292799-- VALGRIND INTERNAL ERROR: Valgrind received a signal 11 (SIGSEGV) - exiting
--292799-- si_code=1;  Faulting address: 0x8;  sp: 0x1002ef2cc0

valgrind: the 'impossible' happened:
   Killed by fatal signal

host stacktrace:
==292799==    at 0x580AE3D3: ??? (in /usr/libexec/valgrind/memcheck-amd64-linux)
==292799==    by 0x580A7ED9: ??? (in /usr/libexec/valgrind/memcheck-amd64-linux)
==292799==    by 0x580A387A: ??? (in /usr/libexec/valgrind/memcheck-amd64-linux)
==292799==    by 0x580A58A6: ??? (in /usr/libexec/valgrind/memcheck-amd64-linux)
==292799==    by 0x58115088: ??? (in /usr/libexec/valgrind/memcheck-amd64-linux)

BTW testcase after fix still fails, but that's I suppose just expected valgrind
behavior on mmap(PROT_NONE), right?

valgrind ./mremap03
==292941== Memcheck, a memory error detector
==292941== Copyright (C) 2002-2026, and GNU GPL'd, by Julian Seward et al.
==292941== Using Valgrind-3.27.1 and LibVEX; rerun with -h for copyright info
==292941== Command: ./mremap03
==292941==
tst_test.c:2061: TINFO: LTP version: 20260930-20-gd494a8e1c9
...
tst_test.c:1895: TINFO: Overall timeout per run is 0h 00m 30s
mremap03.c:42: TFAIL: mremap(bad_addr, memsize, newsize, MREMAP_MAYMOVE) expected EFAULT: EINVAL (22)

Kind regards,
Petr

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [Valgrind-developers] Suggested fix for the mremap03 syscall testcase

[Martin Cermak via ltp]

Hi Petr,

with patched testcase, valgrind doesn't crash any more, at least
my fresh upstream version of valgrind doesn't:

$ git log -1 --oneline testcases/kernel/syscalls/mremap/mremap03.c
3ddcfa8c3 (HEAD -> master) Fix the mremap03 syscall testcase
$ valgrind --version
valgrind-3.28.0.GIT
$ valgrind testcases/kernel/syscalls/mremap/mremap03
==1419973== Memcheck, a memory error detector
==1419973== Copyright (C) 2002-2026, and GNU GPL'd, by Julian Seward et al.
==1419973== Using Valgrind-3.28.0.GIT and LibVEX; rerun with -h for copyright info
==1419973== Command: testcases/kernel/syscalls/mremap/mremap03
==1419973== 
tst_test.c:2061: TINFO: LTP version: 20260930-20-g3ddcfa8c3
tst_test.c:2064: TINFO: Tested kernel: 7.2.7-200.fc44.x86_64 #1 SMP PREEMPT_DYNAMIC Mon Sep 21 18:25:57 UTC 2026 x86_64
tst_kconfig.c:73: TINFO: Couldn't locate kernel config!
tst_test.c:1895: TINFO: Overall timeout per run is 0h 00m 30s
mremap03.c:42: TFAIL: mremap(bad_addr, memsize, newsize, MREMAP_MAYMOVE) expected EFAULT: EINVAL (22)
==1419992== 
==1419992== HEAP SUMMARY:
==1419992==     in use at exit: 0 bytes in 0 blocks
==1419992==   total heap usage: 13 allocs, 13 frees, 7,647 bytes allocated
==1419992== 
==1419992== All heap blocks were freed -- no leaks are possible
==1419992== 
==1419992== For lists of detected and suppressed errors, rerun with: -s
==1419992== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)

Summary:
passed   0
failed   1
broken   0
skipped  0
warnings 0
==1419973== 
==1419973== HEAP SUMMARY:
==1419973==     in use at exit: 0 bytes in 0 blocks
==1419973==   total heap usage: 6 allocs, 6 frees, 4,488 bytes allocated
==1419973== 
==1419973== All heap blocks were freed -- no leaks are possible
==1419973== 
==1419973== For lists of detected and suppressed errors, rerun with: -s
==1419973== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
$

But that doesn't mean things are perfect.  The main problem is
that under valgrind the testcase behaves differently compared to
a run without valgrind. Looking into it.  Thanks for the merge.

Martin

On  Thu  2026-10-15  10:38 , Petr Vorel wrote:
> Hi Martin, Andrea, 
> 
> > Hi Martin,
> 
> > you are right. That’s a bug we didn’t spot during the test rewrite. Thanks.
> 
> Good catch, Martin, you're of course right => turned into proper patch and
> merged.
> 
> valgrind ./mremap03
> tst_test.c:1895: TINFO: Overall timeout per run is 0h 00m 30s
> --292799-- VALGRIND INTERNAL ERROR: Valgrind received a signal 11 (SIGSEGV) - exiting
> --292799-- si_code=1;  Faulting address: 0x8;  sp: 0x1002ef2cc0
> 
> valgrind: the 'impossible' happened:
>    Killed by fatal signal
> 
> host stacktrace:
> ==292799==    at 0x580AE3D3: ??? (in /usr/libexec/valgrind/memcheck-amd64-linux)
> ==292799==    by 0x580A7ED9: ??? (in /usr/libexec/valgrind/memcheck-amd64-linux)
> ==292799==    by 0x580A387A: ??? (in /usr/libexec/valgrind/memcheck-amd64-linux)
> ==292799==    by 0x580A58A6: ??? (in /usr/libexec/valgrind/memcheck-amd64-linux)
> ==292799==    by 0x58115088: ??? (in /usr/libexec/valgrind/memcheck-amd64-linux)
> 
> BTW testcase after fix still fails, but that's I suppose just expected valgrind
> behavior on mmap(PROT_NONE), right?
> 
> valgrind ./mremap03
> ==292941== Memcheck, a memory error detector
> ==292941== Copyright (C) 2002-2026, and GNU GPL'd, by Julian Seward et al.
> ==292941== Using Valgrind-3.27.1 and LibVEX; rerun with -h for copyright info
> ==292941== Command: ./mremap03
> ==292941==
> tst_test.c:2061: TINFO: LTP version: 20260930-20-gd494a8e1c9
> ...
> tst_test.c:1895: TINFO: Overall timeout per run is 0h 00m 30s
> mremap03.c:42: TFAIL: mremap(bad_addr, memsize, newsize, MREMAP_MAYMOVE) expected EFAULT: EINVAL (22)
> 
> Kind regards,
> Petr
> 
> 


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp