[LTP] [PATCH 1/2] syscalls/brk: change to unsigned long to avoid incr overflow

Previously, incr is possible be overflowed at
81	incr = (Max_brk_byte_size - Beg_brk_val) / (MAX_SIZE_LC / 2);
103	nbrkpt = cur_brk_val + (2 * incr);

Signed-off-by: Li Zhijian <redacted>
Signed-off-by: leishaoting <redacted>
---
 testcases/kernel/syscalls/brk/brk01.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/testcases/kernel/syscalls/brk/brk01.c b/testcases/kernel/syscalls/brk/brk01.c
index 9a36431..b470ee7 100644
--- a/testcases/kernel/syscalls/brk/brk01.c
+++ b/testcases/kernel/syscalls/brk/brk01.c

@@ -65,7 +65,7 @@ uintptr_t Beg_brk_val;
 int main(int ac, char **av)
 {
 	int lc;
-	int incr;
+	unsigned long incr;
 	uintptr_t nbrkpt;		/* new brk point value */
 	uintptr_t cur_brk_val;	/* current size returned by sbrk */
 	uintptr_t aft_brk_val;	/* current size returned by sbrk */

-- 
2.7.4

sometimes(some platforms), sbrk(0) will return a huge address(e.g
Beg_brk_val=94392102215680), it will lead to the request a huge
memory by brk(size>1T) which beyonds most host memory size

Signed-off-by: Li Zhijian <redacted>
Signed-off-by: leishaoting <redacted>
---
 testcases/kernel/syscalls/brk/brk01.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/testcases/kernel/syscalls/brk/brk01.c b/testcases/kernel/syscalls/brk/brk01.c
index b470ee7..22b9662 100644
--- a/testcases/kernel/syscalls/brk/brk01.c
+++ b/testcases/kernel/syscalls/brk/brk01.c

@@ -53,6 +53,7 @@ void setup();
 void cleanup();
 
 #define MAX_SIZE_LC	1000	/* loop count test will reach max size */
+#define MAX_INCR	(UINT_MAX / 2)
 
 char *TCID = "brk01";
 int TST_TOTAL = 1;

@@ -83,6 +84,9 @@ int main(int ac, char **av)
 	if ((incr * 2) < 4096)	/* make sure that process will grow */
 		incr += 4096 / 2;
 
+	// limit the requesting memory
+	incr = MIN(MAX_INCR, incr);
+
 	for (lc = 0; TEST_LOOPING(lc); lc++) {
 
 		tst_count = 0;

-- 
2.7.4

Hi!

sometimes(some platforms), sbrk(0) will return a huge address(e.g
Beg_brk_val=94392102215680), it will lead to the request a huge
memory by brk(size>1T) which beyonds most host memory size

I think that the code in the setup that determines the Max_brk_byte_size
does not make any sense to me, it seems to just multiply random value
(the initial break addres) by 4 and uses that as a base for increment. I
guess that it would be much better if we just choosen some multiple of
page size for the test.

Also the test should be running several iterations but we run only one
by default.

All in all I think that it would be much better if we rewrote the test
from scratch using the new test library instead of applying band aids
to problems that are broken by design.

In short, do you want to take on rewriting the test or should I do that?

-- 
Cyril Hrubis
chrubis@suse.cz

On 12/11/2017 11:48 PM, Cyril Hrubis wrote:

Hi!

quoted

sometimes(some platforms), sbrk(0) will return a huge address(e.g
Beg_brk_val=94392102215680), it will lead to the request a huge
memory by brk(size>1T) which beyonds most host memory size

I think that the code in the setup that determines the Max_brk_byte_size
does not make any sense to me, it seems to just multiply random value
(the initial break addres) by 4 and uses that as a base for increment. I
guess that it would be much better if we just choosen some multiple of
page size for the test.

agree

Also the test should be running several iterations but we run only one
by default.

All in all I think that it would be much better if we rewrote the test
from scratch using the new test library instead of applying band aids
to problems that are broken by design.

In short, do you want to take on rewriting the test or should I do that?

it's great if you can help to rewrite it. :)

Thanks