From 4cc64bd6c4cc11614b30cd7d3d42f6fe4ed47919 Mon Sep 17 00:00:00 2001 From: Matthew Lugg Date: Mon, 17 Nov 2025 17:09:54 +0000 Subject: [PATCH] tests: add tcg coverage for fixed mremap bugs These tests cover the first two fixes in this patch series. The final patch is not covered because the bug it fixes is not easily observable by the guest. Signed-off-by: Matthew Lugg Signed-off-by: Richard Henderson Message-ID: <20251117170954.31451-5-mlugg@mlugg.co.uk> (cherry picked from commit 9290c10ae9d0c3ff433efbb7ecb0e781966c5404) Signed-off-by: Michael Tokarev --- tests/tcg/multiarch/test-mmap.c | 42 +++++++++++++++++++++++++++++++-- 1 file changed, 40 insertions(+), 2 deletions(-) diff --git a/tests/tcg/multiarch/test-mmap.c b/tests/tcg/multiarch/test-mmap.c index 96257f8ebe..e297f4b1e9 100644 --- a/tests/tcg/multiarch/test-mmap.c +++ b/tests/tcg/multiarch/test-mmap.c @@ -22,6 +22,7 @@ * along with this program; if not, see . */ +#define _GNU_SOURCE #include #include #include @@ -41,7 +42,7 @@ do \ } \ } while (0) -unsigned char *dummybuf; +unsigned char *dummybuf; /* length is 2*pagesize */ static unsigned int pagesize; static unsigned int pagemask; int test_fd; @@ -451,9 +452,45 @@ void check_invalid_mmaps(void) fail_unless(addr == MAP_FAILED); fail_unless(errno == ENOMEM); + /* Attempt to remap a region which exceeds the bounds of memory. */ + addr = mremap((void *)((uintptr_t)pagesize * 10), SIZE_MAX & ~(size_t)pagemask, pagesize, 0); + fprintf(stdout, "%s mremap addr=%p", __func__, (void *)addr); + fail_unless(addr == MAP_FAILED); + fail_unless(errno == EFAULT); + fprintf(stdout, " passed\n"); } +void check_shrink_mmaps(void) +{ + unsigned char *a, *b, *c; + a = mmap(NULL, pagesize * 2, PROT_READ, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); + b = mmap(NULL, pagesize * 2, PROT_READ, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); + c = mmap(NULL, pagesize * 2, PROT_READ, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); + + fail_unless(a != MAP_FAILED); + fail_unless(b != MAP_FAILED); + fail_unless(c != MAP_FAILED); + + /* Ensure we can read the full mappings */ + memcpy(dummybuf, a, 2 * pagesize); + memcpy(dummybuf, b, 2 * pagesize); + memcpy(dummybuf, c, 2 * pagesize); + + /* Shrink the middle mapping in-place; the others should be unaffected */ + b = mremap(b, pagesize * 2, pagesize, 0); + fail_unless(b != MAP_FAILED); + + /* Ensure we can still access all valid mappings */ + memcpy(dummybuf, a, 2 * pagesize); + memcpy(dummybuf, b, pagesize); + memcpy(dummybuf, c, 2 * pagesize); + + munmap(a, 2 * pagesize); + munmap(b, pagesize); + munmap(c, 2 * pagesize); +} + int main(int argc, char **argv) { char tempname[] = "/tmp/.cmmapXXXXXX"; @@ -468,7 +505,7 @@ int main(int argc, char **argv) /* Assume pagesize is a power of two. */ pagemask = pagesize - 1; - dummybuf = malloc (pagesize); + dummybuf = malloc (pagesize * 2); printf ("pagesize=%u pagemask=%x\n", pagesize, pagemask); test_fd = mkstemp(tempname); @@ -496,6 +533,7 @@ int main(int argc, char **argv) check_file_fixed_eof_mmaps(); check_file_unfixed_eof_mmaps(); check_invalid_mmaps(); + check_shrink_mmaps(); /* Fails at the moment. */ /* check_aligned_anonymous_fixed_mmaps_collide_with_host(); */