kern/60502: kern: mremap(2) cannot grow a shared anonymous mapping

["Serhiy Storchaka via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60502
>Category:       kern
>Synopsis:       mremap(2) cannot grow a shared anonymous mapping
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Jul 25 02:50:01 +0000 2026
>Originator:     Serhiy Storchaka
>Release:        NetBSD 10.1
>Environment:

NetBSD 10.1 amd64 (GENERIC).

>Description:

mremap(2) growing a shared anonymous mapping returns a non-MAP_FAILED
pointer whose grown region is not backed by memory, so accessing it
faults (SIGSEGV).  Only MAP_SHARED is affected; MAP_PRIVATE grows
correctly.

This is the same behaviour as Linux kernel bug 8691, which Linux fixed by
refusing such a grow.  The mremap(2) man page does not document it.

>How-To-Repeat:

     #include <sys/mman.h>
     #include <string.h>

     int main(void)
     {
             void *p = mmap(NULL, 4096, PROT_READ|PROT_WRITE,
                            MAP_ANON|MAP_SHARED, -1, 0);
             memset(p, 'A', 4096);
             p = mremap(p, 4096, p, 8192, 0);   /* returns, does not fail */
             ((char *)p)[4096] = 'B';           /* SIGSEGV: unbacked 
region */
             return 0;
     }

Crashes on the write to the grown page.  Using MAP_PRIVATE makes it
succeed.

>Fix:

mremap() should grow shared anonymous mappings correctly, or fail with
MAP_FAILED, rather than return an unbacked region.

>Unformatted: