[LTP] [PATCH 3/3] mmap24: add test for MAP_32BIT address limit

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

Add a test verifying that mmap() with the MAP_32BIT flag restricts
mappings to the first 2GB of address space and fails with ENOMEM
when the 32-bit address space is exhausted without falling back to
higher addresses.

Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 runtest/syscalls                          |  1 +
 testcases/kernel/syscalls/mmap/.gitignore |  1 +
 testcases/kernel/syscalls/mmap/mmap24.c   | 96 +++++++++++++++++++++++++++++++
 3 files changed, 98 insertions(+)

diff --git a/runtest/syscalls b/runtest/syscalls
index a264f42c8..ef235668e 100644
--- a/runtest/syscalls
+++ b/runtest/syscalls
@@ -891,6 +891,7 @@ mmap21_01 mmap21 -m 1
 mmap21_02 mmap21
 mmap22 mmap22
 mmap23 mmap23
+mmap24 mmap24
 
 modify_ldt01 modify_ldt01
 modify_ldt02 modify_ldt02
diff --git a/testcases/kernel/syscalls/mmap/.gitignore b/testcases/kernel/syscalls/mmap/.gitignore
index dd332e9a1..f072e7f64 100644
--- a/testcases/kernel/syscalls/mmap/.gitignore
+++ b/testcases/kernel/syscalls/mmap/.gitignore
@@ -20,3 +20,4 @@
 /mmap21
 /mmap22
 /mmap23
+/mmap24
diff --git a/testcases/kernel/syscalls/mmap/mmap24.c b/testcases/kernel/syscalls/mmap/mmap24.c
new file mode 100644
index 000000000..50de620f4
--- /dev/null
+++ b/testcases/kernel/syscalls/mmap/mmap24.c
@@ -0,0 +1,96 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (C) 2026 SUSE LLC Andrea Cervesato <andrea.cervesato@suse.com>
+ */
+
+/*\
+ * Verify that :manpage:`mmap(2)` with the MAP_32BIT flag restricts all mappings
+ * to the first 2GB of the process address space (< 0x80000000).
+ *
+ * MAP_32BIT is supported only on x86-64 for 64-bit programs.
+ *
+ * [Algorithm]
+ *
+ * - Repeatedly call mmap() allocating 32MB chunks with MAP_32BIT until ENOMEM
+ * - Verify that every returned address satisfies (addr + size) <= 0x80000000
+ * - Verify that memory in each chunk is readable and writable
+ * - Verify that at least one chunk was mapped and failure errno is ENOMEM
+ * - Unmap all allocated chunks in cleanup
+ */
+
+#include "tst_test.h"
+#include "lapi/mmap.h"
+
+#define ADDR_LIMIT 0x80000000UL
+#define CHUNK_SZ (32UL * TST_MB)
+#define MAX_CHUNKS 64
+
+static void *addrs[MAX_CHUNKS];
+static size_t num_chunks;
+
+static void cleanup(void)
+{
+	size_t i;
+
+	for (i = 0; i < num_chunks; i++) {
+		if (addrs[i]) {
+			SAFE_MUNMAP(addrs[i], CHUNK_SZ);
+			addrs[i] = NULL;
+		}
+	}
+	num_chunks = 0;
+}
+
+static void run(void)
+{
+	size_t i;
+	int failed_with_enomem = 0;
+
+	for (i = 0; i < MAX_CHUNKS; i++) {
+		void *addr = mmap(NULL, CHUNK_SZ, PROT_READ | PROT_WRITE,
+				  MAP_PRIVATE | MAP_ANONYMOUS | MAP_32BIT, -1, 0);
+
+		if (addr == MAP_FAILED) {
+			if (errno == ENOMEM)
+				failed_with_enomem = 1;
+			else
+				tst_res(TFAIL | TERRNO,
+					"mmap() failed with unexpected errno");
+			break;
+		}
+
+		if ((unsigned long)addr + CHUNK_SZ > ADDR_LIMIT) {
+			tst_res(TFAIL, "mapping at %p + %zu exceeds 2GB limit",
+				addr, CHUNK_SZ);
+			addrs[num_chunks++] = addr;
+			cleanup();
+			return;
+		}
+
+		((char *)addr)[0] = 'a';
+		((char *)addr)[CHUNK_SZ - 1] = 'z';
+
+		addrs[num_chunks++] = addr;
+	}
+
+	if (!failed_with_enomem) {
+		tst_res(TFAIL, "32-bit address space was not exhausted");
+	} else if (!num_chunks) {
+		tst_res(TFAIL, "failed to map any chunk with MAP_32BIT");
+	} else {
+		tst_res(TPASS,
+			"Mapped %zu MB across %zu chunks within 2GB before ENOMEM",
+			(num_chunks * CHUNK_SZ) / TST_MB, num_chunks);
+	}
+
+	cleanup();
+}
+
+static struct tst_test test = {
+	.cleanup = cleanup,
+	.test_all = run,
+	.supported_archs = (const char *const []){
+		"x86_64",
+		NULL
+	},
+};

-- 
2.51.0