[LTP] [PATCH v6] hugemmap43: Migrate truncate_sigbus_versus_oom from libhugetlbfs

[LTP] [PATCH v6] hugemmap43: Migrate truncate_sigbus_versus_oom from libhugetlbfs

[Samir Mulani]

Some kernels have a bug in the positioning of the test against
i_size. This bug means that attempting to instantiate a page
beyond the end of a hugepage file can result in an OOM and SIGKILL
instead of the correct SIGBUS.

Signed-off-by: Samir Mulani <samir@linux.ibm.com>
---
v6:
1. Fixed subject line to use imperative mood.
2. Dropped vague opening sentence from the commit description.
3. Fixed grammar: "Some kernel have" -> "Some kernels have".
4. Added 'static' keyword to setup() and cleanup().
5. Zero-initialized struct sigaction sa with '= {}' and sigemptyset().
6. Replaced SA_SIGINFO with sa.sa_flags = 0 to match sa_handler usage.
7. Removed dead totpages assignment from setup().
8. Added SAFE_MUNMAP() for p and q at end of run_test() to fix fd/mmap
   leak on -i N runs.
9. Fixed cleanup() guard from 'fd > 0' to 'fd != -1' to correctly
   handle fd value 0.

Patch:
https://lore.kernel.org/ltp/20260317102059.6699-1-samir@linux.ibm.com/ #v5

 runtest/hugetlb                               |   1 +
 testcases/kernel/mem/.gitignore               |   1 +
 .../kernel/mem/hugetlb/hugemmap/hugemmap43.c  | 101 ++++++++++++++++++
 3 files changed, 103 insertions(+)
 create mode 100644 testcases/kernel/mem/hugetlb/hugemmap/hugemmap43.c

diff --git a/runtest/hugetlb b/runtest/hugetlb
index 6b35c1f42..36d2ded36 100644
--- a/runtest/hugetlb
+++ b/runtest/hugetlb
@@ -40,6 +40,7 @@ hugemmap35 hugemmap35
 hugemmap36 hugemmap36
 hugemmap37 hugemmap37
 hugemmap38 hugemmap38
+hugemmap43 hugemmap43
 hugemmap05_1 hugemmap05 -m
 hugemmap05_2 hugemmap05 -s
 hugemmap05_3 hugemmap05 -s -m
diff --git a/testcases/kernel/mem/.gitignore b/testcases/kernel/mem/.gitignore
index e63a6dde7..ab8e54bad 100644
--- a/testcases/kernel/mem/.gitignore
+++ b/testcases/kernel/mem/.gitignore
@@ -40,6 +40,7 @@
 /hugetlb/hugemmap/hugemmap36
 /hugetlb/hugemmap/hugemmap37
 /hugetlb/hugemmap/hugemmap38
+/hugetlb/hugemmap/hugemmap43
 /hugetlb/hugeshmat/hugeshmat01
 /hugetlb/hugeshmat/hugeshmat02
 /hugetlb/hugeshmat/hugeshmat03
diff --git a/testcases/kernel/mem/hugetlb/hugemmap/hugemmap43.c b/testcases/kernel/mem/hugetlb/hugemmap/hugemmap43.c
new file mode 100644
index 000000000..3bd8413b6
--- /dev/null
+++ b/testcases/kernel/mem/hugetlb/hugemmap/hugemmap43.c
@@ -0,0 +1,101 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (C) 2005-2006 David Gibson & Adam Litke, IBM Corporation.
+ */
+
+/*\
+ * Some kernels have a bug in the positioning of the test against
+ * i_size. This bug means that attempting to instantiate a page
+ * beyond the end of a hugepage file can result in an OOM and SIGKILL
+ * instead of the correct SIGBUS.
+ */
+
+#include "hugetlb.h"
+#include <setjmp.h>
+#include <signal.h>
+
+#define MNTPOINT "hugetlbfs/"
+static int fd = -1, fdx = -1;
+
+static unsigned long long hpage_size;
+
+static sigjmp_buf sig_escape;
+static volatile int test_pass;
+
+static void sigbus_handler(int signum LTP_ATTRIBUTE_UNUSED)
+{
+	test_pass = 1;
+	siglongjmp(sig_escape, 17);
+}
+
+static void run_test(void)
+{
+	void *p, *q;
+	unsigned long totpages;
+	unsigned long i;
+
+	test_pass = 0;
+
+	fd = tst_creat_unlinked(MNTPOINT, 0, 0600);
+	p = SAFE_MMAP(NULL, hpage_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
+	SAFE_FTRUNCATE(fd, 0);
+
+	fdx = tst_creat_unlinked(MNTPOINT, 0, 0600);
+	totpages = SAFE_READ_MEMINFO(MEMINFO_HPAGE_FREE);
+	q = SAFE_MMAP(NULL, totpages * hpage_size, PROT_READ | PROT_WRITE,
+		      MAP_SHARED, fdx, 0);
+
+	/* Touch the pages to ensure they're removed from the pool */
+	for (i = 0; i < totpages; i++) {
+		volatile char *x = (volatile char *)q + i * hpage_size;
+		*x = 0;
+	}
+
+	/* SIGBUS is what *should* happen */
+	SAFE_FTRUNCATE(fdx, 0);
+	if (sigsetjmp(sig_escape, 1) == 0)
+		*((volatile unsigned int *)p);
+
+	if (test_pass)
+		tst_res(TPASS, "Expected SIGBUS triggered");
+	else
+		tst_res(TFAIL, "Didn't SIGBUS");
+
+	SAFE_MUNMAP(p, hpage_size);
+	SAFE_MUNMAP(q, totpages * hpage_size);
+	SAFE_CLOSE(fd);
+	SAFE_CLOSE(fdx);
+	fd = -1;
+	fdx = -1;
+}
+
+static void setup(void)
+{
+	struct sigaction sa = {};
+
+	sigemptyset(&sa.sa_mask);
+	sa.sa_flags = 0;
+	sa.sa_handler = sigbus_handler;
+	SAFE_SIGACTION(SIGBUS, &sa, NULL);
+	hpage_size = tst_get_hugepage_size();
+}
+
+static void cleanup(void)
+{
+	if (fd != -1)
+		SAFE_CLOSE(fd);
+	if (fdx != -1)
+		SAFE_CLOSE(fdx);
+}
+
+static struct tst_test test = {
+	.tags = (struct tst_tag[]){{"linux-git", "ebed4bfc8da8"}, {}},
+	.needs_root = 1,
+	.mntpoint = MNTPOINT,
+	.needs_hugetlbfs = 1,
+	.needs_tmpdir = 1,
+	.setup = setup,
+	.cleanup = cleanup,
+	.test_all = run_test,
+	.hugepages = {1, TST_NEEDS},
+};
-- 
2.52.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] hugemmap43: Migrate truncate_sigbus_versus_oom from libhugetlbfs

[linuxtestproject.agent]

Hi Samir,

On Thu, Aug 20, 2026, Samir Mulani wrote:
> hugemmap43: Migrate truncate_sigbus_versus_oom from libhugetlbfs

> 	/* SIGBUS is what *should* happen */
> 	SAFE_FTRUNCATE(fdx, 0);
> 	if (sigsetjmp(sig_escape, 1) == 0)
> 		*((volatile unsigned int *)p);

Why is fdx truncated before faulting p? The original test keeps q
instantiated so that the hugepage pool remains exhausted. On a kernel
without ebed4bfc8da8, exhausting the pool makes allocation fail before the
missing i_size check, causing SIGKILL instead of SIGBUS.

Could this truncate be removed or moved after the fault? As written, it
releases the pages and no longer exercises the SIGBUS-versus-OOM regression
described by the commit message and test documentation.

> /*\
>  * Some kernels have a bug in the positioning of the test against
>  * i_size. This bug means that attempting to instantiate a page
>  * beyond the end of a hugepage file can result in an OOM and SIGKILL
>  * instead of the correct SIGBUS.
>  */
> [...]
> 	.needs_root = 1,

Could the description explain why root is required? LTP requires tests with
.needs_root to document the reason for the privilege requirement.

> +/hugetlb/hugemmap/hugemmap43

Could the binary instead be added to a .gitignore in the hugemmap directory?
LTP requires new test binaries to be ignored in their leaf test directory.

> 	SAFE_CLOSE(fd);
> 	SAFE_CLOSE(fdx);
> 	fd = -1;
> 	fdx = -1;

Could the explicit assignments be removed? SAFE_CLOSE() already sets each
descriptor argument to -1, and LTP's C test rules prohibit resetting it
manually.

Verdict - Needs revision

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp