Re: [LTP] hugemmap37: migrated task-size-overrun.c from libhugetlbfs v4

[linuxtestproject.agent@gmail.com]

Hi Pavithra,

On Sat Apr 4 2026, Pavithra wrote:
> hugemmap37: migrated task-size-overrun.c from libhugetlbfs v4

> +static unsigned long find_last_mapped(void)
> +{
> +	char line[MAPS_BUF_SZ];
> +	...
> +	/* Read all lines and keep the last non-special mapping */
> +	while (fgets(line, MAPS_BUF_SZ, f)) {
> +		/* Skip special mappings like [vsyscall], [vdso], [vvar] */
> +		if (strstr(line, "[vsyscall]") || strstr(line, "[vdso]") ||
> +		    strstr(line, "[vvar]"))
> +			continue;
> +
> +		found = 1;
> +	}
> +	...
> +	tst_res(TINFO, "Last map: %s", line);
> +	if (sscanf(line, "%lx-%lx %*s %lx %*s %ld", &start, &end, &off, &ino) != 4)

The comment says "keep the last non-special mapping" but the code does
not do that.  fgets() overwrites `line` on every iteration, including
iterations that immediately hit the `continue`.  After the loop, `line`
holds the last line read overall, not the last non-special line.

On x86_64 with vsyscall support, [vsyscall] appears as the final entry
in /proc/self/maps at address 0xffffffffff600000.  In that case sscanf
parses that address and find_last_mapped() returns 0xffffffffff601000.
find_task_size() then starts its binary search with a low-PFN value
already above TASK_SIZE, all probe mmaps fail, and an incorrect
TASK_SIZE is returned -- making straddle_addr wrong and the test
results unreliable.

The fix is to copy `line` into a separate buffer when a non-special
line is encountered, and use that saved buffer after the loop.

> +// SPDX-License-Identifier: LGPL-2.1-or-later

Other tests in this directory that were migrated from the same
libhugetlbfs upstream (e.g. hugemmap34.c, which credits the same
original authors) carry GPL-2.0-or-later.  LTP relicenses migrated
code under GPL-2.0-or-later for consistency.

> +/*
> + * Origin: https://github.com/libhugetlbfs/...
> + *
> + * This test verifies the behavior of mmap across the TASK_SIZE boundary.

The high-level description block must open with /*\ (backslash after
the slash-star) so that the LTP documentation build recognises it as
an RST-formatted block and includes it in the test catalog.  A plain
/* comment is silently ignored by the doc toolchain.

Verdict - Needs revision

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp