On Fri, Jul 11, 2025 at 1:38 PM Lorenzo Stoakes lorenzo.stoakes@oracle.com wrote:
Note that any failures encountered will result in a partial move. Since an mremap() can fail at any time, this might result in only some of the VMAs being moved.
Note that failures are very rare and typically require an out of a memory condition or a mapping limit condition to be hit, assuming the VMAs being moved are valid.
Hrm. So if userspace tries to move a series of VMAs with mremap(), and the operation fails, and userspace assumes the old syscall semantics, userspace could assume that its memory is still at the old address, when that's actually not true; and if userspace tries to access it there, userspace UAF happens?
If we were explicitly killing the userspace process on this error path, that'd be fine; but since we're just returning an error, we're kind of making userspace believe that the move hasn't happened? (You might notice that I'm generally in favor of killing userspace processes when userspace does sufficiently weird things.)
I guess it's not going to happen particularly often since mremap() with MREMAP_FIXED is a weirdly specific operation in the first place; normal users of mremap() (like libc's realloc()) wouldn't have a reason to use it...