gh-138204: Forbid expansion of a shared anonymous mmap on Linux

This is a Linux kernel bug which caused a bus error.
https://bugzilla.kernel.org/show_bug.cgi?id=8691

Author: serhiy-storchaka

Lib/test/test_mmap.py

@@ -500,12 +500,81 @@ def test_anonymous(self):
         for x in range(PAGESIZE):
             self.assertEqual(m[x], 0,
                              "anonymously mmap'ed contents should be zero")
+        with self.assertRaises(IndexError):
+            m[PAGESIZE]
 
         for x in range(PAGESIZE):
             b = x & 0xff
             m[x] = b
             self.assertEqual(m[x], b)
 
+        if sys.platform.startswith('linux'):
+            # Can't expand a shared anonymous mapping on Linux.
+            # See https://bugzilla.kernel.org/show_bug.cgi?id=8691
+            with self.assertRaises(ValueError):
+                m.resize(2 * PAGESIZE)
+        else:
+            try:
+                m.resize(2 * PAGESIZE)
+            except SystemError:
+                pass
+            else:
+                for x in range(PAGESIZE):
+                    self.assertEqual(m[x], x & 0xff)
+                for x in range(PAGESIZE, 2 * PAGESIZE):
+                    self.assertEqual(m[x], 0)
+                with self.assertRaises(IndexError):
+                    m[2 * PAGESIZE]
+
+                for x in range(PAGESIZE, 2 * PAGESIZE):
+                    b = x & 0xff
+                    m[x] = b
+                    self.assertEqual(m[x], b)
+
+        try:
+            m.resize(PAGESIZE // 2)
+        except SystemError:
+            pass
+        else:
+            for x in range(PAGESIZE // 2):
+                self.assertEqual(m[x], x & 0xff)
+            with self.assertRaises(IndexError):
+                m[PAGESIZE // 2]
+
+        if sys.platform.startswith('linux'):
+            # Can't expand to its original size.
+            with self.assertRaises(ValueError):
+                m.resize(PAGESIZE)
+
+    def test_private_anonymous(self):
+        m = mmap.mmap(-1, PAGESIZE, flags=mmap.MAP_PRIVATE)
+        for x in range(PAGESIZE):
+            self.assertEqual(m[x], 0)
+        with self.assertRaises(IndexError):
+            m[PAGESIZE]
+
+        for x in range(PAGESIZE):
+            b = x & 0xff
+            m[x] = b
+            self.assertEqual(m[x], b)
+
+        try:
+            m.resize(2 * PAGESIZE)
+        except SystemError:
+            pass
+        else:
+            for x in range(PAGESIZE):
+                self.assertEqual(m[x], x & 0xff)
+            for x in range(PAGESIZE, 2 * PAGESIZE):
+                self.assertEqual(m[x], 0)
+            with self.assertRaises(IndexError):
+                m[2 * PAGESIZE]
+
+            for x in range(PAGESIZE, 2 * PAGESIZE):
+                b = x & 0xff
+                m[x] = b
+                self.assertEqual(m[x], b)
+
     def test_read_all(self):
         m = mmap.mmap(-1, 16)
         self.addCleanup(m.close)

Misc/NEWS.d/next/Library/2025-08-28-13-20-09.gh-issue-138204.8oLOud.rst

@@ -0,0 +1,2 @@
+Forbid expansion of shared anonymous :mod:`memory maps <mmap>` on Linux,
+which caused a bus error.

Modules/mmapmodule.c

@@ -120,6 +120,7 @@ typedef struct {
 #ifdef UNIX
     int fd;
     _Bool trackfd;
+    int flags;
 #endif
 
     PyObject *weakreflist;
@@ -889,6 +890,13 @@ mmap_resize_method(PyObject *op, PyObject *args)
 #else
         void *newmap;
 
+#ifdef __linux__
+        if (self->fd == -1 && !(self->flags & MAP_PRIVATE) && new_size > self->size) {
+            PyErr_Format(PyExc_ValueError,
+                "mmap: can't expand a shared anonymous mapping on Linux");
+            return NULL;
+        }
+#endif
         if (self->fd != -1 && ftruncate(self->fd, self->offset + new_size) == -1) {
             PyErr_SetFromErrno(PyExc_OSError);
             return NULL;
@@ -1685,6 +1693,7 @@ new_mmap_object(PyTypeObject *type, PyObject *args, PyObject *kwdict)
     else {
         m_obj->fd = -1;
     }
+    m_obj->flags = flags;
 
     Py_BEGIN_ALLOW_THREADS
     m_obj->data = mmap(NULL, map_size, prot, flags, fd, offset);