syscalls/fork: add new case fork14

This testcase is a reproducer for https://lkml.org/lkml/2012/4/24/328.[1]
Modified from Siddhesh Poyarekar's testcase posted on above link. Since vma length in dup_mmap is calculated and stored in a unsigned int, which is insufficient and hence overflows for very large maps (beyond 16TB). Once overflow occurred, the fork after mmaped memory > 16TB will succeed incorrectly.

This case will run following loop:
+ mmap one (more) GB memory
+ fork and check return value.
When mmaped more than 16 * 1024 GB, it will check if fork still fail. Expected result: Fork failed even if mmaped memory > 16 * 1024 GB

The issue has been fixed by:
commit 7edc8b0ac16cbaed7cb4ea4c6b95ce98d2997e84
Author: Siddhesh Poyarekar <[email protected]>
mm/fork: fix overflow in vma length when copying mmap on clone

I've added an .gitignore record for the fork13 binary, removed the set

testcases/kernel/syscalls/fork/fork14.c line 97

Quoted 13 lines

testcases/kernel/syscalls/fork/fork14.c new file +13 -0

+static void cleanup(void)
+{
+	TEST_CLEANUP;
+}
+
+static int fork_test(void)
+{
+	int i, ret = 0;
+	void *addr;
+
+	for (i = 0; i < EXTENT; i++) {
+		addr = mmap(NULL, 1 * GB, PROT_READ | PROT_WRITE,
+			MAP_PRIVATE | MAP_ANONYMOUS, 0, 0);

I have some question here.
In you v2 patch, you added some code to determine the fail of mmap():

Review

Quoted 4 lines

addr = mmap(NULL, (size_t) 1 * GB, PROT_READ | PROT_WRITE,

(quoted diff) +3 -0

+			MAP_PRIVATE | MAP_ANONYMOUS, 0, 0);
+		if (addr == MAP_FAILED)
+			tst_brkm(TBROK|TERRNO, cleanup, "mmap");

But in v3 patch, you deleted it. I think this maybe not right in some conditions.

If in this for loop, mmap() fails for 10000 times(Indeed, I don't know whether it would occur), then we won't get a memory map, whose vm_area_struct is 16TB size, so the overflow won't occur.

So I think TCONF should be return in case mmap() failes. At least, we can ensure we have a vm_area_struct sized 16TB.

According to the Siddhesh Poyarekar's mail, he attached a more clearer test program. #include <unistd.h>
#include <sys/mman.h>
#include <errno.h>

#define GIG 1024 * 1024 * 1024L
#define EXTENT 16393

int main(void)

{
        int i, r;
        void *m;
        char buf[1024];
        int prev_failed = 0;

        for (i = 0; i < EXTENT; i++) {
                printf("i %d\n", i);
                m = mmap(NULL, (size_t) 1 * 1024 * 1024 * 1024L,
                         PROT_READ | PROT_WRITE, MAP_PRIVATE |
                         MAP_ANONYMOUS, 0, 0);

                if (m == (void *)-1) {
                        printf("MMAP Failed: %d\n", errno);
                        return 1;
                }

                r = fork();

                if (r == 0) {
                        return 0;
                } else if (r < 0) {
                        prev_failed = 1;
                        /* Fork failed as expected */
                } else if (r > 0 && prev_failed) {
                        printf("Unexpected success at %d\n", i);
                        wait(NULL);
                        return 1;
                }
        }

        return 0;
}

I think this test program will be more appropriate. If the test failed before, then prev_failed is 1, and if we continue to mmap,the vm_area_struct's size will continue to extend. If overflow does not occur, that is the bug is not exist, then fork will continue to fail. But if in some point, fork() success, then we can determine the overflow occurs now.