[PATCH] tools/testing/vma: cover hole filling through __mmap_region()

[PATCH] tools/testing/vma: cover hole filling through __mmap_region()

[Tianyi Chen]

The mmap tests extend existing mappings one neighbor at a time, while
merge tests construct merge state directly. Neither exercises filling
a hole between compatible mappings through the mmap setup and completion
path.

Fill a gap through __mmap_region() and require both neighbors to merge
into one VMA. Repeat with only the new mapping's execute permission set
and require three separate VMAs. Check boundaries, permissions, page
offsets, map_count and tree lookups across the mapped pages.

The full VMA test suite passes all 28 tests with ASan and UBSan enabled.

Assisted-by: LLM
Signed-off-by: Tianyi Chen <hi@tychen.cc>
---
 tools/testing/vma/tests/mmap.c | 75 ++++++++++++++++++++++++++++++++++
 1 file changed, 75 insertions(+)

diff --git a/tools/testing/vma/tests/mmap.c b/tools/testing/vma/tests/mmap.c
index c85bc000d1c..b66ec932a75 100644
--- a/tools/testing/vma/tests/mmap.c
+++ b/tools/testing/vma/tests/mmap.c
@@ -45,7 +45,82 @@ static bool test_mmap_region_basic(void)
 	return true;
 }
 
+static bool mmap_region_fill_hole(bool merge)
+{
+	const vma_flags_t vma_flags = mk_vma_flags(VMA_READ_BIT, VMA_WRITE_BIT,
+			VMA_MAYREAD_BIT, VMA_MAYWRITE_BIT, VMA_MAYEXEC_BIT);
+	vma_flags_t hole_flags = vma_flags;
+	struct mm_struct mm = {};
+	struct vm_area_struct *vma;
+	unsigned long addr;
+	int count = 0;
+	VMA_ITERATOR(vmi, &mm, 0);
+
+	current->mm = &mm;
+	if (!merge)
+		vma_flags_set(&hole_flags, VMA_EXEC_BIT);
+
+	/* Leave a hole between two otherwise mergeable mappings. */
+	addr = __mmap_region(NULL, 0x300000, 0x3000, vma_flags, 0x300, NULL);
+	ASSERT_EQ(addr, 0x300000);
+	addr = __mmap_region(NULL, 0x306000, 0x3000, vma_flags, 0x306, NULL);
+	ASSERT_EQ(addr, 0x306000);
+	ASSERT_EQ(mm.map_count, 2);
+	vma_iter_set(&vmi, 0x303000);
+	ASSERT_EQ(vma_iter_load(&vmi), NULL);
+	vma_iter_set(&vmi, 0x305fff);
+	ASSERT_EQ(vma_iter_load(&vmi), NULL);
+
+	/* A single flag difference must prevent merging with either neighbor. */
+	addr = __mmap_region(NULL, 0x303000, 0x3000, hole_flags, 0x303, NULL);
+	ASSERT_EQ(addr, 0x303000);
+	ASSERT_EQ(mm.map_count, merge ? 1 : 3);
+
+	vma_iter_set(&vmi, 0);
+	for_each_vma(vmi, vma) {
+		unsigned long start = 0x300000 + count * 0x3000;
+		unsigned long end = merge ? 0x309000 : start + 0x3000;
+		VMA_ITERATOR(lookup, &mm, start);
+
+		ASSERT_EQ(vma->vm_start, start);
+		ASSERT_EQ(vma->vm_end, end);
+		ASSERT_EQ(vma_start_pgoff(vma), start >> PAGE_SHIFT);
+		ASSERT_EQ(vma_start_anon_pgoff(vma), start >> PAGE_SHIFT);
+		ASSERT_TRUE(vma_test_all(vma, VMA_READ_BIT, VMA_WRITE_BIT,
+					VMA_MAYREAD_BIT, VMA_MAYWRITE_BIT,
+					VMA_MAYEXEC_BIT));
+		ASSERT_EQ(vma_test(vma, VMA_EXEC_BIT), !merge && count == 1);
+		for (addr = start; addr < end; addr += PAGE_SIZE) {
+			vma_iter_set(&lookup, addr);
+			ASSERT_EQ(vma_iter_load(&lookup), vma);
+			vma_iter_set(&lookup, addr + PAGE_SIZE - 1);
+			ASSERT_EQ(vma_iter_load(&lookup), vma);
+		}
+		count++;
+	}
+	ASSERT_EQ(count, mm.map_count);
+	vma_iter_set(&vmi, 0x2fffff);
+	ASSERT_EQ(vma_iter_load(&vmi), NULL);
+	vma_iter_set(&vmi, 0x309000);
+	ASSERT_EQ(vma_iter_load(&vmi), NULL);
+
+	ASSERT_EQ(cleanup_mm(&mm, &vmi), count);
+	return true;
+}
+
+static bool test_mmap_region_fill_hole_merge(void)
+{
+	return mmap_region_fill_hole(true);
+}
+
+static bool test_mmap_region_fill_hole_flags_mismatch(void)
+{
+	return mmap_region_fill_hole(false);
+}
+
 static void run_mmap_tests(int *num_tests, int *num_fail)
 {
 	TEST(mmap_region_basic);
+	TEST(mmap_region_fill_hole_merge);
+	TEST(mmap_region_fill_hole_flags_mismatch);
 }
-- 
2.55.0

Re: [PATCH] tools/testing/vma: cover hole filling through __mmap_region()

[Lorenzo Stoakes (ARM)]

On Sun, Sep 06, 2026 at 10:41:00PM +0800, Tianyi Chen wrote:
> The mmap tests extend existing mappings one neighbor at a time, while
> merge tests construct merge state directly. Neither exercises filling
> a hole between compatible mappings through the mmap setup and completion
> path.
>
> Fill a gap through __mmap_region() and require both neighbors to merge
> into one VMA. Repeat with only the new mapping's execute permission set
> and require three separate VMAs. Check boundaries, permissions, page
> offsets, map_count and tree lookups across the mapped pages.
>
> The full VMA test suite passes all 28 tests with ASan and UBSan enabled.
>
> Assisted-by: LLM

Thanks for adding the tag, always much appreciated!

I may actually set my own LLM loose on these tests to expand some more. Is
a good area for such work I think.

Though it still needs massaging to get good code :)

> Signed-off-by: Tianyi Chen <hi@tychen.cc>

General idea seems reasonable to me, and never any harm in adding more
tests :)

A bunch of stuff to fix below, but with those addressed patch should be
good.

Also please rebase this on the mm-unstable branch of Andrew's tree:

https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git/

As there is a minor conflict with my upcoming work :)

> ---
>  tools/testing/vma/tests/mmap.c | 75 ++++++++++++++++++++++++++++++++++
>  1 file changed, 75 insertions(+)
>
> diff --git a/tools/testing/vma/tests/mmap.c b/tools/testing/vma/tests/mmap.c
> index c85bc000d1c..b66ec932a75 100644
> --- a/tools/testing/vma/tests/mmap.c
> +++ b/tools/testing/vma/tests/mmap.c
> @@ -45,7 +45,82 @@ static bool test_mmap_region_basic(void)
>  	return true;
>  }
>
> +static bool mmap_region_fill_hole(bool merge)
> +{
> +	const vma_flags_t vma_flags = mk_vma_flags(VMA_READ_BIT, VMA_WRITE_BIT,
> +			VMA_MAYREAD_BIT, VMA_MAYWRITE_BIT, VMA_MAYEXEC_BIT);
> +	vma_flags_t hole_flags = vma_flags;

Hole is the wrong word, maybe 'middle_flags'?

> +	struct mm_struct mm = {};
> +	struct vm_area_struct *vma;
> +	unsigned long addr;
> +	int count = 0;
> +	VMA_ITERATOR(vmi, &mm, 0);
> +
> +	current->mm = &mm;
> +	if (!merge)
> +		vma_flags_set(&hole_flags, VMA_EXEC_BIT);
> +
> +	/* Leave a hole between two otherwise mergeable mappings. */
> +	addr = __mmap_region(NULL, 0x300000, 0x3000, vma_flags, 0x300, NULL);
> +	ASSERT_EQ(addr, 0x300000);
> +	addr = __mmap_region(NULL, 0x306000, 0x3000, vma_flags, 0x306, NULL);
> +	ASSERT_EQ(addr, 0x306000);
> +	ASSERT_EQ(mm.map_count, 2);

Everything here is reasonable but can you please add comments like other tests
like:

	/* Map at 0x306000, length 0x3000. */

etc.

> +	vma_iter_set(&vmi, 0x303000);
> +	ASSERT_EQ(vma_iter_load(&vmi), NULL);
> +	vma_iter_set(&vmi, 0x305fff);
> +	ASSERT_EQ(vma_iter_load(&vmi), NULL);

Let's drop these 4 lines they're a bit useless I think.

> +
> +	/* A single flag difference must prevent merging with either neighbor. */

Similar to above re: comment.

Also worth saying

> +	addr = __mmap_region(NULL, 0x303000, 0x3000, hole_flags, 0x303, NULL);
> +	ASSERT_EQ(addr, 0x303000);
> +	ASSERT_EQ(mm.map_count, merge ? 1 : 3);
> +
> +	vma_iter_set(&vmi, 0);
> +	for_each_vma(vmi, vma) {
> +		unsigned long start = 0x300000 + count * 0x3000;
> +		unsigned long end = merge ? 0x309000 : start + 0x3000;

NIT: Can we make these const please?

> +		VMA_ITERATOR(lookup, &mm, start);
> +
> +		ASSERT_EQ(vma->vm_start, start);
> +		ASSERT_EQ(vma->vm_end, end);
> +		ASSERT_EQ(vma_start_pgoff(vma), start >> PAGE_SHIFT);
> +		ASSERT_EQ(vma_start_anon_pgoff(vma), start >> PAGE_SHIFT);

Newline here maybe as basic stuff above.

> +		ASSERT_TRUE(vma_test_all(vma, VMA_READ_BIT, VMA_WRITE_BIT,
> +					VMA_MAYREAD_BIT, VMA_MAYWRITE_BIT,
> +					VMA_MAYEXEC_BIT));
> +		ASSERT_EQ(vma_test(vma, VMA_EXEC_BIT), !merge && count == 1);

Also can we separate out the !merge && count bit? So put this at the start
of the for_each_vma() block:

	/* If testing the non-merge case, middle VMA will be set VMA_EXEC. */
	const bool is_middle_vma = count == 1;
	const expect_exec_vma = is_middle_vma && !merge;

Then here:

	ASSERT_EQ(vma_test(vma, VMA_EXEC_BIT), expect_exec_vma);

Also a newline here would be nice.

> +		for (addr = start; addr < end; addr += PAGE_SIZE) {
> +			vma_iter_set(&lookup, addr);
> +			ASSERT_EQ(vma_iter_load(&lookup), vma);
> +			vma_iter_set(&lookup, addr + PAGE_SIZE - 1);
> +			ASSERT_EQ(vma_iter_load(&lookup), vma);
> +		}

Let's drop this entire block please I don't think it's achieving anything
useful.

> +		count++;
> +	}

Newline here please.

> +	ASSERT_EQ(count, mm.map_count);
> +	vma_iter_set(&vmi, 0x2fffff);
> +	ASSERT_EQ(vma_iter_load(&vmi), NULL);
> +	vma_iter_set(&vmi, 0x309000);
> +	ASSERT_EQ(vma_iter_load(&vmi), NULL);

Again let's drop this block, it's not useful I don't think.

> +
> +	ASSERT_EQ(cleanup_mm(&mm, &vmi), count);
> +	return true;
> +}
> +
> +static bool test_mmap_region_fill_hole_merge(void)
> +{
> +	return mmap_region_fill_hole(true);
> +}
> +
> +static bool test_mmap_region_fill_hole_flags_mismatch(void)
> +{
> +	return mmap_region_fill_hole(false);
> +}
> +
>  static void run_mmap_tests(int *num_tests, int *num_fail)
>  {
>  	TEST(mmap_region_basic);
> +	TEST(mmap_region_fill_hole_merge);
> +	TEST(mmap_region_fill_hole_flags_mismatch);
>  }
> --
> 2.55.0
>

--
Cheers, Lorenzo

Re: [PATCH] tools/testing/vma: cover hole filling through __mmap_region()

[Tianyi Chen]

Thanks for the detailed review.

I have rebased onto mm-unstable and incorporated the requested naming,
comments, const qualifiers and simplifications, while retaining the new
/dev/zero test. All 29 VMA tests pass with ASan and UBSan enabled.

The revised v2 patch is here:
https://lore.kernel.org/r/178886112560.138404.17741948638665342936.vma-v2@tychen.cc

Thanks,
Tianyi

[PATCH v2] tools/testing/vma: cover hole filling through __mmap_region()

[Tianyi Chen]

The mmap tests extend existing mappings one neighbor at a time, while
merge tests construct merge state directly. Neither exercises filling
a hole between compatible mappings through the mmap setup and completion
path.

Fill a gap through __mmap_region() and require both neighbors to merge
into one VMA. Repeat with only the new mapping's execute permission set
and require three separate VMAs. Check boundaries, permissions, page
offsets, map_count and cleanup.

Signed-off-by: Tianyi Chen <hi@tychen.cc>
Assisted-by: Codex:GPT-6
---
Changes in v2:
- Rebase onto mm-unstable, preserving the new /dev/zero test.
- Rename hole_flags to middle_flags and describe each mapping's address
  and length in its comment.
- Remove the redundant hole, per-page and outer-boundary iterator checks.
- Use const bounds and named booleans for the middle VMA's expected execute
  permission, and separate assertion groups for readability.

Validation: all 29 VMA tests passed with ASan and UBSan enabled, built
with clang 20 using the existing VMA Makefile.

v1: https://lore.kernel.org/r/20260906144100.849288-1-hi@tychen.cc
Review: https://lore.kernel.org/r/ap5pmX-RddQ-c90O@gremlin

 tools/testing/vma/tests/mmap.c | 68 ++++++++++++++++++++++++++++++++++
 1 file changed, 68 insertions(+)

diff --git a/tools/testing/vma/tests/mmap.c b/tools/testing/vma/tests/mmap.c
index fa73faff226..53e4abe6a63 100644
--- a/tools/testing/vma/tests/mmap.c
+++ b/tools/testing/vma/tests/mmap.c
@@ -45,6 +45,72 @@ static bool test_mmap_region_basic(void)
 	return true;
 }
 
+static bool mmap_region_fill_hole(bool merge)
+{
+	const vma_flags_t vma_flags = mk_vma_flags(VMA_READ_BIT, VMA_WRITE_BIT,
+			VMA_MAYREAD_BIT, VMA_MAYWRITE_BIT, VMA_MAYEXEC_BIT);
+	vma_flags_t middle_flags = vma_flags;
+	struct mm_struct mm = {};
+	struct vm_area_struct *vma;
+	unsigned long addr;
+	int count = 0;
+	VMA_ITERATOR(vmi, &mm, 0);
+
+	current->mm = &mm;
+	if (!merge)
+		vma_flags_set(&middle_flags, VMA_EXEC_BIT);
+
+	/* Map at 0x300000, length 0x3000. */
+	addr = __mmap_region(NULL, 0x300000, 0x3000, vma_flags, 0x300, NULL);
+	ASSERT_EQ(addr, 0x300000);
+
+	/* Map at 0x306000, length 0x3000, leaving a hole. */
+	addr = __mmap_region(NULL, 0x306000, 0x3000, vma_flags, 0x306, NULL);
+	ASSERT_EQ(addr, 0x306000);
+	ASSERT_EQ(mm.map_count, 2);
+
+	/* Map at 0x303000, length 0x3000, filling the hole. */
+	addr = __mmap_region(NULL, 0x303000, 0x3000, middle_flags, 0x303, NULL);
+	ASSERT_EQ(addr, 0x303000);
+	ASSERT_EQ(mm.map_count, merge ? 1 : 3);
+
+	vma_iter_set(&vmi, 0);
+	for_each_vma(vmi, vma) {
+		const unsigned long start = 0x300000 + count * 0x3000;
+		const unsigned long end = merge ? 0x309000 : start + 0x3000;
+		/* Only the middle VMA in the non-merge case has VMA_EXEC. */
+		const bool is_middle_vma = count == 1;
+		const bool expect_exec_vma = is_middle_vma && !merge;
+
+		ASSERT_EQ(vma->vm_start, start);
+		ASSERT_EQ(vma->vm_end, end);
+		ASSERT_EQ(vma_start_pgoff(vma), start >> PAGE_SHIFT);
+		ASSERT_EQ(vma_start_anon_pgoff(vma), start >> PAGE_SHIFT);
+
+		ASSERT_TRUE(vma_test_all(vma, VMA_READ_BIT, VMA_WRITE_BIT,
+					 VMA_MAYREAD_BIT, VMA_MAYWRITE_BIT,
+					 VMA_MAYEXEC_BIT));
+		ASSERT_EQ(vma_test(vma, VMA_EXEC_BIT), expect_exec_vma);
+
+		count++;
+	}
+
+	ASSERT_EQ(count, mm.map_count);
+
+	ASSERT_EQ(cleanup_mm(&mm, &vmi), count);
+	return true;
+}
+
+static bool test_mmap_region_fill_hole_merge(void)
+{
+	return mmap_region_fill_hole(true);
+}
+
+static bool test_mmap_region_fill_hole_flags_mismatch(void)
+{
+	return mmap_region_fill_hole(false);
+}
+
 static bool test_pure_anon_dev_zero(void)
 {
 	const vma_flags_t vma_flags = mk_vma_flags(VMA_READ_BIT, VMA_WRITE_BIT,
@@ -84,5 +150,7 @@ static bool test_pure_anon_dev_zero(void)
 static void run_mmap_tests(int *num_tests, int *num_fail)
 {
 	TEST(mmap_region_basic);
+	TEST(mmap_region_fill_hole_merge);
+	TEST(mmap_region_fill_hole_flags_mismatch);
 	TEST(pure_anon_dev_zero);
 }
-- 
2.55.0

Re: [PATCH v2] tools/testing/vma: cover hole filling through __mmap_region()

[Lorenzo Stoakes (ARM)]

On Tue, Sep 08, 2026 at 05:55:15PM +0800, Tianyi Chen wrote:
> The mmap tests extend existing mappings one neighbor at a time, while
> merge tests construct merge state directly. Neither exercises filling
> a hole between compatible mappings through the mmap setup and completion
> path.
>
> Fill a gap through __mmap_region() and require both neighbors to merge
> into one VMA. Repeat with only the new mapping's execute permission set
> and require three separate VMAs. Check boundaries, permissions, page
> offsets, map_count and cleanup.
>
> Signed-off-by: Tianyi Chen <hi@tychen.cc>

For future - please always send v2 patches not in-reply-to anything :P otherwise
mails get buried.

Otherwise all LGTM, thanks for addressing feedback! So:

Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>

> Assisted-by: Codex:GPT-6
> ---
> Changes in v2:
> - Rebase onto mm-unstable, preserving the new /dev/zero test.
> - Rename hole_flags to middle_flags and describe each mapping's address
>   and length in its comment.
> - Remove the redundant hole, per-page and outer-boundary iterator checks.
> - Use const bounds and named booleans for the middle VMA's expected execute
>   permission, and separate assertion groups for readability.
>
> Validation: all 29 VMA tests passed with ASan and UBSan enabled, built
> with clang 20 using the existing VMA Makefile.
>
> v1: https://lore.kernel.org/r/20260906144100.849288-1-hi@tychen.cc
> Review: https://lore.kernel.org/r/ap5pmX-RddQ-c90O@gremlin

Thanks! :) very nice.

>
>  tools/testing/vma/tests/mmap.c | 68 ++++++++++++++++++++++++++++++++++
>  1 file changed, 68 insertions(+)
>
> diff --git a/tools/testing/vma/tests/mmap.c b/tools/testing/vma/tests/mmap.c
> index fa73faff226..53e4abe6a63 100644
> --- a/tools/testing/vma/tests/mmap.c
> +++ b/tools/testing/vma/tests/mmap.c
> @@ -45,6 +45,72 @@ static bool test_mmap_region_basic(void)
>  	return true;
>  }
>
> +static bool mmap_region_fill_hole(bool merge)
> +{
> +	const vma_flags_t vma_flags = mk_vma_flags(VMA_READ_BIT, VMA_WRITE_BIT,
> +			VMA_MAYREAD_BIT, VMA_MAYWRITE_BIT, VMA_MAYEXEC_BIT);
> +	vma_flags_t middle_flags = vma_flags;
> +	struct mm_struct mm = {};
> +	struct vm_area_struct *vma;
> +	unsigned long addr;
> +	int count = 0;
> +	VMA_ITERATOR(vmi, &mm, 0);
> +
> +	current->mm = &mm;
> +	if (!merge)
> +		vma_flags_set(&middle_flags, VMA_EXEC_BIT);
> +
> +	/* Map at 0x300000, length 0x3000. */
> +	addr = __mmap_region(NULL, 0x300000, 0x3000, vma_flags, 0x300, NULL);
> +	ASSERT_EQ(addr, 0x300000);
> +
> +	/* Map at 0x306000, length 0x3000, leaving a hole. */
> +	addr = __mmap_region(NULL, 0x306000, 0x3000, vma_flags, 0x306, NULL);
> +	ASSERT_EQ(addr, 0x306000);
> +	ASSERT_EQ(mm.map_count, 2);
> +
> +	/* Map at 0x303000, length 0x3000, filling the hole. */
> +	addr = __mmap_region(NULL, 0x303000, 0x3000, middle_flags, 0x303, NULL);
> +	ASSERT_EQ(addr, 0x303000);
> +	ASSERT_EQ(mm.map_count, merge ? 1 : 3);
> +
> +	vma_iter_set(&vmi, 0);
> +	for_each_vma(vmi, vma) {
> +		const unsigned long start = 0x300000 + count * 0x3000;
> +		const unsigned long end = merge ? 0x309000 : start + 0x3000;
> +		/* Only the middle VMA in the non-merge case has VMA_EXEC. */
> +		const bool is_middle_vma = count == 1;
> +		const bool expect_exec_vma = is_middle_vma && !merge;
> +
> +		ASSERT_EQ(vma->vm_start, start);
> +		ASSERT_EQ(vma->vm_end, end);
> +		ASSERT_EQ(vma_start_pgoff(vma), start >> PAGE_SHIFT);
> +		ASSERT_EQ(vma_start_anon_pgoff(vma), start >> PAGE_SHIFT);
> +
> +		ASSERT_TRUE(vma_test_all(vma, VMA_READ_BIT, VMA_WRITE_BIT,
> +					 VMA_MAYREAD_BIT, VMA_MAYWRITE_BIT,
> +					 VMA_MAYEXEC_BIT));
> +		ASSERT_EQ(vma_test(vma, VMA_EXEC_BIT), expect_exec_vma);
> +
> +		count++;
> +	}
> +
> +	ASSERT_EQ(count, mm.map_count);
> +
> +	ASSERT_EQ(cleanup_mm(&mm, &vmi), count);
> +	return true;
> +}
> +
> +static bool test_mmap_region_fill_hole_merge(void)
> +{
> +	return mmap_region_fill_hole(true);
> +}
> +
> +static bool test_mmap_region_fill_hole_flags_mismatch(void)
> +{
> +	return mmap_region_fill_hole(false);
> +}
> +
>  static bool test_pure_anon_dev_zero(void)
>  {
>  	const vma_flags_t vma_flags = mk_vma_flags(VMA_READ_BIT, VMA_WRITE_BIT,
> @@ -84,5 +150,7 @@ static bool test_pure_anon_dev_zero(void)
>  static void run_mmap_tests(int *num_tests, int *num_fail)
>  {
>  	TEST(mmap_region_basic);
> +	TEST(mmap_region_fill_hole_merge);
> +	TEST(mmap_region_fill_hole_flags_mismatch);
>  	TEST(pure_anon_dev_zero);
>  }
> --
> 2.55.0
>

--
Cheers, Lorenzo