NetBSD Problem Report #60470

From storchaka@gmail.com  Mon Jul 20 13:44:05 2026
Return-Path: <storchaka@gmail.com>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 10C011A923D
	for <gnats-bugs@gnats.NetBSD.org>; Mon, 20 Jul 2026 13:44:05 +0000 (UTC)
Message-Id: <f9445a9b-4d20-44d0-9a53-cf05ab9e22f2@gmail.com>
Date: Mon, 20 Jul 2026 16:43:57 +0300
From: Serhiy Storchaka <storchaka@gmail.com>
Reply-To:
To: gnats-bugs@netbsd.org
Subject: mremap(2) cannot grow a shared anonymous mapping
X-From4GNATS: "Serhiy Storchaka via gnats" <gnats-admin@NetBSD.org>

>Number:         60470
>Category:       kern
>Synopsis:       mremap(2) cannot grow a shared anonymous mapping
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   unknown
>Arrival-Date:   Mon Jul 20 13:45:00 +0000 2026
>Last-Modified:  Tue Sep 01 07:17:12 +0000 2026
>Originator:     Serhiy Storchaka <storchaka@gmail.com>
>Release:        
>Organization:

>Environment:

>Description:

 mremap(2) growing a shared anonymous mapping returns a non-MAP_FAILED
 pointer whose grown region is not backed by memory, so accessing it
 faults (SIGSEGV).  Only MAP_SHARED is affected; MAP_PRIVATE grows
 correctly.

 This is the same behaviour as Linux kernel bug 8691, which Linux fixed by
 refusing such a grow.  The mremap(2) man page does not document it.

  >How-To-Repeat:

      #include <sys/mman.h>
      #include <string.h>

      int main(void)
      {
              void *p = mmap(NULL, 4096, PROT_READ|PROT_WRITE,
                             MAP_ANON|MAP_SHARED, -1, 0);
              memset(p, 'A', 4096);
              p = mremap(p, 4096, p, 8192, 0);   /* returns, does not fail */
              ((char *)p)[4096] = 'B';           /* SIGSEGV: unbacked 
 region */
              return 0;
      }

 Crashes on the write to the grown page.  Using MAP_PRIVATE makes it
 succeed.

  >Fix:

 mremap() should grow shared anonymous mappings correctly, or fail with
 MAP_FAILED, rather than return an unbacked region.

  >Environment:

 NetBSD 10.1 amd64 (GENERIC).

>How-To-Repeat:

>Fix:

Unknown
>Release-Note:

>Audit-Trail:

Responsible-Changed-From-To: gnats-admin->kern-bug-people
Responsible-Changed-By: bsiegert@NetBSD.org
Responsible-Changed-When: Tue, 01 Sep 2026 07:17:12 +0000
Responsible-Changed-Why:
correct (I hope) role account


>Unformatted:

Home	PR Database Search