mm: preserve file_vma type when cloning a child address space on fork

clone_address_space() rebuilt EVERY child VMA as an anon_vma, so a fork
child's file-backed mappings (file_vma -- e.g. the ELF loader's file-backed
.text, mapped via map_file) became anonymous in the child.  A demand fault on
a child file-backed page that the parent had not already resident-loaded then
dispatched to the base zero-fill path instead of file_vma::fault reading the
file: the child read (or executed) zeros.  This is the "wild-branch" bug that
blocked file-backed fork workloads such as PostgreSQL, whose checkpointer child
faults large cold .text regions the postmaster never touched.

Preserve each parent VMA's dynamic type across the clone:

  - In the VMA-clone loop (under the parent's vmas_mutex), dynamic_cast each
    vma to file_vma.  For a file_vma, rebuild the child's copy via the file's
    own mmap() -- the SAME call map_file and file_vma::split use -- so the
    child gets the correct page_allocator (map_file_page_read for MAP_PRIVATE,
    map_file_page_mmap for a cached/shared mapping) and its demand faults read
    the file.  The new file_vma holds its own fileref.  Anon vmas still clone
    as anon_vma.  file::mmap()/default_file_mmap()/map_file_mmap() are pure
    allocation (no locks, no I/O), matching the anon_vma allocation this loop
    already performs under the lock.

  - In destroy_address_space(), dispose the child's owned vma objects before
    freeing the address space.  ~file_vma releases the fileref this child took
    (and deletes its page_allocator), closing the file-reference leak the type
    preservation would otherwise introduce -- and also the pre-existing
    anon_vma + edge-marker leak.  ~vma touches no global list, so disposing
    here is safe.

The whole change is inside #if CONF_fork, so a conf_fork=0 build is
byte-identical.

Adds tests/tst-fork-file-mmap.cc (gated via the fork test group): a parent
mmaps a read-only ROFS file MAP_PRIVATE without faulting a mid-file page,
forks, and the child faults that page first -- it must read the real file
bytes, not zeros.  Reproduces the bug on the unfixed tree (child reads 0x00)
and passes with this fix (child reads the real byte).

Signed-off-by: Greg Burd <greg@burd.me>

Author: gburd

core/mmu.cc

@@ -487,13 +487,36 @@ address_space *clone_address_space(address_space *parent)
         // Structurally clone the parent's VMAs into the child's vma_list so
         // the fault path can resolve child faults (permissions, backing).  The
         // physical pages are already wired via the cloned page tables above.
+        //
+        // Preserve each parent vma's DYNAMIC TYPE.  A file_vma (e.g. the ELF
+        // loader's file-backed .text, created via map_file) must clone as a
+        // file_vma bound to the SAME file + offset -- otherwise the child's
+        // demand faults dispatch to the base zero-fill path and it executes
+        // zeros over its own .text (the fork COW-clone wild-branch bug).  A
+        // file-backed vma is rebuilt via the file's own mmap() -- the SAME
+        // call map_file and file_vma::split use -- so the child gets the
+        // correct page_allocator (map_file_page_read for MAP_PRIVATE,
+        // map_file_page_mmap for a cached/shared mapping) and its demand
+        // faults read the file instead of zero-filling.  The new file_vma
+        // holds its OWN fileref; ~file_vma in destroy_address_space releases
+        // it.  file::mmap()/default_file_mmap()/map_file_mmap() are pure
+        // allocation (no locks, no I/O), so calling them here under
+        // vmas_mutex is safe -- the same as the anon_vma allocation this loop
+        // already does under the lock.
         for (auto &v : *parent->vmas) {
             // Skip the edge marker VMAs (size 0); the child's vma_list_type
             // constructor already inserted its own edge markers.
             if (v.size() == 0) {
                 continue;
             }
-            auto *nv = new anon_vma(addr_range(v.start(), v.end()), v.perm(), v.flags());
+            vma *nv;
+            auto *fv = dynamic_cast<file_vma *>(&v);
+            if (fv) {
+                nv = fv->file()->mmap(addr_range(v.start(), v.end()),
+                                      v.flags(), v.perm(), fv->offset()).release();
+            } else {
+                nv = new anon_vma(addr_range(v.start(), v.end()), v.perm(), v.flags());
+            }
             child->vmas->insert(*nv);
         }
         return child;
@@ -565,6 +588,16 @@ void destroy_address_space(address_space *as)
         }
         memory::free_page(phys_to_virt(pml4_phys));
     }
+    // Dispose the child's own vma objects (the clones built in
+    // clone_address_space, plus the vma_list edge markers).  ~vma is a no-op
+    // for the base/anon case; for a file_vma it deletes the page_allocator and
+    // releases the fileref this child took in clone_address_space -- so the
+    // file-backed clone does not leak its file reference.  (This also closes
+    // the pre-existing anon_vma + edge-marker leak.)  ~vma touches no global
+    // list, so disposing here is safe.
+    if (as->owned_vmas) {
+        as->owned_vmas->clear_and_dispose([](vma *v) { delete v; });
+    }
     delete as;
     live_child_address_spaces.fetch_sub(1, std::memory_order_relaxed);
 }

modules/tests/Makefile

@@ -131,7 +131,7 @@ tests := tst-pthread.so misc-ramdisk.so tst-vblk.so tst-mq-smoke.so tst-bsd-evh.
 	misc-ctxsw.so tst-read.so tst-symlink.so tst-openat.so \
 	tst-eventfd.so tst-remove.so misc-wake.so tst-epoll.so misc-lfring.so \
 	tst-fork.so tst-execve.so payload-exit7.so \
-	tst-fork-cow.so tst-fork-deep.so \
+	tst-fork-cow.so tst-fork-deep.so tst-fork-file-mmap.so \
 	misc-fsx.so tst-sleep.so tst-resolve.so tst-except.so \
 	misc-tcp-sendonly.so tst-tcp-nbwrite.so misc-tcp-hash-srv.so \
 	misc-loadbalance.so misc-scheduler.so tst-console.so tst-app.so \

tests/tst-fork-file-mmap.cc

@@ -0,0 +1,130 @@
+/*
+ * Copyright (C) 2026 Greg Burd
+ *
+ * This work is open source software, licensed under the terms of the
+ * BSD license as described in the LICENSE file in the top-level directory.
+ *
+ * REGRESSION TEST for [W-branch]: a fork child that demand-faults a page of a
+ * FILE-backed (MAP_PRIVATE) mapping which the PARENT never touched before the
+ * fork.  Before the clone_address_space type-preservation fix this returned
+ * ZEROS (the bug): clone_address_space rebuilt EVERY child vma as an anon_vma,
+ * so a file_vma (e.g. PostgreSQL's file-backed .text, mapped by the ELF loader)
+ * became anonymous in the child and its demand fault hit the base zero-fill
+ * path instead of file_vma::fault reading the file.  It now PASSES (the child
+ * reads the real file bytes).
+ *
+ * The mapping is of a READ-ONLY ROFS file -- matching the real case (an
+ * executable's file-backed .text, demand-paged from the read-only image), and
+ * avoiding the writable-fs access-time update that would otherwise write to the
+ * inode during a read fault.
+ *
+ * Root cause (proven via KVM+hbreak, see /tmp/w-branch-kvm.txt):
+ *   core/mmu.cc clone_address_space():
+ *     struct vma_snap { start, end, perm, flags; };     // dropped dynamic type
+ *     snap.push_back({v.start(), v.end(), v.perm(), v.flags()});
+ *     auto *nv = new anon_vma(...);                      // ALWAYS anon_vma
+ *   The child's file-backed VA thus faulted to a fresh ZERO anon page.  The
+ *   existing tst-fork* tests only exercise ANON memory, so they miss it; PG is
+ *   the first fork whose child demand-faults a file-backed .text page the
+ *   parent never resident-loaded.
+ *
+ * Mechanism the test recreates:
+ *   - parent opens a ROFS file and reads the EXPECTED bytes of a mid-file page
+ *     via pread(2) on a SEPARATE fd (this never faults the mapping's PTE);
+ *   - parent mmaps the file MAP_PRIVATE but does NOT read the target page (so
+ *     no PTE for it exists in the parent -> the COW page-table clone hands the
+ *     child an absent PTE);
+ *   - fork();
+ *   - the CHILD reads the target page FIRST -> demand fault -> must read the
+ *     real file bytes.  On buggy HEAD it reads zeros (MISMATCH).
+ *
+ * Deterministic on -smp 1.  Gated CONF_fork.
+ *
+ * To reproduce (in arena-dev, CONF_fork=y build):
+ *   ./scripts/build conf_fork=1 fs=rofs image=tests, then:
+ *   ./scripts/run.py -c 1 -e /tests/tst-fork-file-mmap.so
+ */
+
+#include <unistd.h>
+#include <sys/wait.h>
+#include <sys/types.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <cstdio>
+#include <cstring>
+#include <cstdint>
+#include <cerrno>
+
+int main()
+{
+    printf("=== tst-fork-file-mmap ===\n");
+    const size_t page = (size_t)sysconf(_SC_PAGESIZE);
+
+    // A read-only ROFS file present on the test image (~47 KiB).
+    const char *path = "/rofs/mmap-file-test1";
+    int fd = open(path, O_RDONLY);
+    if (fd < 0) {
+        // fall back to the /tmp copy the image also ships
+        fd = open("/tmp/mmap-file-test1", O_RDONLY);
+    }
+    if (fd < 0) { printf("FAIL: open %s (%s)\n", path, strerror(errno)); return 1; }
+
+    struct stat st;
+    if (fstat(fd, &st) != 0) { printf("FAIL: fstat\n"); return 1; }
+    size_t size = (size_t)st.st_size;
+    if (size < 6 * page) { printf("FAIL: file too small (%zu)\n", size); return 1; }
+
+    // Target page the child will fault: a mid-file page (well past page 0) that
+    // the parent never touches through the mapping.
+    const size_t target_pg = 5;
+    const off_t target_off = (off_t)(target_pg * page);
+
+    // Read the EXPECTED bytes of that page via a SEPARATE fd + pread -- this
+    // does not fault the mapping's PTE, so the child still demand-faults it.
+    unsigned char *want = new unsigned char[page];
+    {
+        int fd2 = open(path, O_RDONLY);
+        if (fd2 < 0) fd2 = open("/tmp/mmap-file-test1", O_RDONLY);
+        if (fd2 < 0) { printf("FAIL: open2\n"); return 1; }
+        ssize_t n = pread(fd2, want, page, target_off);
+        close(fd2);
+        if (n != (ssize_t)page) { printf("FAIL: pread expected page (%zd)\n", n); return 1; }
+    }
+
+    // mmap the file MAP_PRIVATE, read-only.  Do NOT touch the target page.
+    unsigned char *p = (unsigned char *)mmap(nullptr, size, PROT_READ,
+                                             MAP_PRIVATE, fd, 0);
+    if (p == MAP_FAILED) { printf("FAIL: mmap (%s)\n", strerror(errno)); return 1; }
+    close(fd);  // mmap holds its own fileref
+
+    pid_t pid = fork();
+    if (pid == 0) {
+        // CHILD: first access to the target page -> demand fault.  On buggy HEAD
+        // this reads a zero-filled anon page; with the fix it reads file bytes.
+        volatile unsigned char got0 = p[target_off];
+        int bad = memcmp((const void *)(p + target_off), want, page);
+        printf("child: page %zu byte0=0x%02x want=0x%02x %s\n",
+               target_pg, (unsigned)got0, (unsigned)want[0],
+               bad ? "MISMATCH" : "OK");
+        _exit(bad ? 70 : 55);
+    }
+
+    int status = 0;
+    waitpid(pid, &status, 0);
+    munmap(p, size);
+    delete[] want;
+
+    if (WIFEXITED(status) && WEXITSTATUS(status) == 55) {
+        printf("PASS: fork child reads real file bytes from an untouched "
+               "file-backed mmap page\n");
+        return 0;
+    }
+    if (WIFEXITED(status) && WEXITSTATUS(status) == 70) {
+        printf("FAIL/BUG [W-branch]: child saw ZEROS/wrong data -- file_vma "
+               "cloned as anon_vma (status=0x%x)\n", status);
+    } else {
+        printf("FAIL: child aborted (status=0x%x)\n", status);
+    }
+    return 1;
+}