mmap.resize() crashes on NetBSD when growing a shared anonymous mapping

[serhiy-storchaka]

Crash report

On NetBSD, mmap.resize() crashes (SIGSEGV) when growing a shared anonymous mapping:

import mmap
m = mmap.mmap(-1, 4096)      # shared anonymous mapping
m[:] = b'A' * 4096
m.resize(8192)               # "succeeds"
m[4096]                      # SIGSEGV

resize() returns without error and the original page is still readable, but the grown region is not backed, so accessing it crashes.

The cause is NetBSD's mremap(): growing a MAP_SHARED | MAP_ANON mapping returns a mapping whose new region is unmapped (verified with a standalone C program — a MAP_PRIVATE anonymous mapping grows correctly, a MAP_SHARED one does not). This is the same behaviour as the Linux kernel bug that Modules/mmapmodule.c already guards against for __linux__ (https://bugzilla.kernel.org/show_bug.cgi?id=8691); Linux later made mremap() reject the grow, but NetBSD still returns the broken mapping. Because NetBSD's mremap() does not return MAP_FAILED, the failure can't be detected from its return value.

The NetBSD behaviour is undocumented (not in the mremap(2) BUGS section) and appears unreported upstream.

Fix: reject growing a shared anonymous mapping on NetBSD with ValueError, as is already done on Linux.

Linked PRs

• gh-154258: Fix mmap.resize() crash on NetBSD growing a shared anonymous mapping #154259
• [3.15] gh-154258: Fix mmap.resize() crash on NetBSD growing a shared anonymous mapping (GH-154259) #154262
• [3.14] gh-154258: Fix mmap.resize() crash on NetBSD growing a shared anonymous mapping (GH-154259) #154263
• [3.13] gh-154258: Fix mmap.resize() crash on NetBSD growing a shared anonymous mapping (GH-154259) #154264