[LTP] [PATCH v3 3/3] mmap24: add test for MAP_32BIT address limit

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

Add a test verifying that mmap() with the MAP_32BIT flag restricts
mappings to the first 2GB of address space and fails with ENOMEM
when the 32-bit address space is exhausted without falling back to
higher addresses.

Reviewed-by: Cyril Hrubis <chrubis@suse.cz>
Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 runtest/syscalls                          |   1 +
 testcases/kernel/syscalls/mmap/.gitignore |   1 +
 testcases/kernel/syscalls/mmap/mmap24.c   | 112 ++++++++++++++++++++++++++++++
 3 files changed, 114 insertions(+)

diff --git a/runtest/syscalls b/runtest/syscalls
index 56f88c0b6..418e8f64d 100644
--- a/runtest/syscalls
+++ b/runtest/syscalls
@@ -891,6 +891,7 @@ mmap21_01 mmap21 -m 1
 mmap21_02 mmap21
 mmap22 mmap22
 mmap23 mmap23
+mmap24 mmap24
 
 modify_ldt01 modify_ldt01
 modify_ldt02 modify_ldt02
diff --git a/testcases/kernel/syscalls/mmap/.gitignore b/testcases/kernel/syscalls/mmap/.gitignore
index dd332e9a1..f072e7f64 100644
--- a/testcases/kernel/syscalls/mmap/.gitignore
+++ b/testcases/kernel/syscalls/mmap/.gitignore
@@ -20,3 +20,4 @@
 /mmap21
 /mmap22
 /mmap23
+/mmap24
diff --git a/testcases/kernel/syscalls/mmap/mmap24.c b/testcases/kernel/syscalls/mmap/mmap24.c
new file mode 100644
index 000000000..2152036a4
--- /dev/null
+++ b/testcases/kernel/syscalls/mmap/mmap24.c
@@ -0,0 +1,112 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (C) 2026 SUSE LLC Andrea Cervesato <andrea.cervesato@suse.com>
+ */
+
+/*\
+ * Verify that :manpage:`mmap(2)` with the MAP_32BIT flag restricts all mappings
+ * to the first 2GB of the process address space (< 0x80000000).
+ *
+ * MAP_32BIT is supported only on x86-64 for 64-bit programs.
+ *
+ * Use PROT_NONE to test address placement without allocating data pages
+ * or charging private writable memory against the commit limit.
+ *
+ * [Algorithm]
+ *
+ * - Repeatedly reserve 32MB chunks with MAP_32BIT and PROT_NONE until ENOMEM
+ * - Verify that every returned address satisfies (addr + size) <= 0x80000000
+ * - Verify that at least one chunk was mapped and failure errno is ENOMEM
+ * - Before releasing any chunks, try the same mapping without MAP_32BIT
+ * - Report TCONF if the unrestricted mapping also fails with ENOMEM,
+ *   otherwise verify that it succeeds
+ * - Unmap all allocated chunks in cleanup
+ */
+
+#include "tst_test.h"
+#include "lapi/mmap.h"
+
+#define ADDR_LIMIT 0x80000000UL
+#define CHUNK_SZ (32UL * TST_MB)
+#define MAX_CHUNKS 64
+
+static void *addrs[MAX_CHUNKS];
+static size_t num_chunks;
+
+static void cleanup(void)
+{
+	size_t i;
+
+	for (i = 0; i < num_chunks; i++) {
+		if (addrs[i]) {
+			SAFE_MUNMAP(addrs[i], CHUNK_SZ);
+			addrs[i] = NULL;
+		}
+	}
+	num_chunks = 0;
+}
+
+static void run(void)
+{
+	size_t i;
+	void *addr;
+
+	for (i = 0; i < MAX_CHUNKS; i++) {
+		TESTPTR(mmap(NULL, CHUNK_SZ, PROT_NONE,
+			     MAP_PRIVATE | MAP_ANONYMOUS | MAP_32BIT, -1, 0));
+		addr = TST_RET_PTR;
+
+		if (addr == MAP_FAILED) {
+			if (TST_ERR != ENOMEM) {
+				tst_res(TFAIL | TTERRNO,
+					"mmap() failed with unexpected errno");
+				goto out;
+			}
+			break;
+		}
+
+		addrs[num_chunks++] = addr;
+
+		if ((unsigned long)addr + CHUNK_SZ > ADDR_LIMIT) {
+			tst_res(TFAIL, "mapping at %p + %lu exceeds 2GB limit",
+				addr, CHUNK_SZ);
+			goto out;
+		}
+	}
+
+	if (i == MAX_CHUNKS) {
+		tst_res(TFAIL, "MAP_32BIT did not fail with ENOMEM");
+		goto out;
+	}
+
+	/* Keep the chunks mapped so the control sees the same resource usage. */
+	TESTPTR(mmap(NULL, CHUNK_SZ, PROT_NONE,
+		     MAP_PRIVATE | MAP_ANONYMOUS, -1, 0));
+	if (TST_RET_PTR == MAP_FAILED) {
+		if (TST_ERR == ENOMEM)
+			tst_brk(TCONF | TTERRNO,
+				"Unrestricted mmap() also failed; result inconclusive");
+		tst_brk(TBROK | TTERRNO,
+			"Unrestricted mmap() failed unexpectedly");
+	}
+	SAFE_MUNMAP(TST_RET_PTR, CHUNK_SZ);
+
+	if (!num_chunks)
+		tst_res(TFAIL, "failed to map any chunk with MAP_32BIT");
+	else
+		tst_res(TPASS,
+			"Mapped %lu MB across %zu chunks within 2GB before ENOMEM",
+			(num_chunks * CHUNK_SZ) / TST_MB, num_chunks);
+
+out:
+	cleanup();
+}
+
+static struct tst_test test = {
+	.cleanup = cleanup,
+	.test_all = run,
+	.supported_archs = (const char *const []){
+		"x86_64",
+		NULL
+	},
+};

-- 
2.51.0