Re: truncate shows non zero data beyond the end of the inode with MAP_SHARED

[Helge Hafting <helge.hafting@hist.no>]

Andrea Arcangeli wrote:

>On Thu, Sep 16, 2004 at 10:49:33AM +0200, Helge Hafting wrote:
>  
>
>>Could this "garbage" possibly be confidential data?
>>    
>>
>
>I don't buy much in this theory.
>
>  
>
>>I.e. one user repeatedly makes and mmaps a 1-byte file,
>>extends it to 4k, and looks at the 4095 bytes of "garbage".
>>Maybe he finds some "interesting stuff" when someone else's
>>confidential file just got dropped from pagecache
>>so he could mmap this 1-byte file?
>>    
>>
>
>the old data got flushed below the i_size anyways, it sounds very
>strange that confidential data is present only over the i_size and not
>below the i_size, and if this guy has confidential data below the i_size
>then it'd better memset the whole page. And in theory nobody should touch
>the data over the i_size even if mmap allows to map it.
>  
>
I am not talking about someone  accidentally stumbling onto
something.  I was worried about someone deliberately
trying to exploit this - such people look at data above i_size
_because they can_, hoping to find something interesting there.
Something they cannot get at normally.

I am assuming that the "garbage" between i_size and the
page boundary is stuff left over from whatever that
memory page was used for earlier?  If so, it could be
4095 bytes out of the 4096 that was used to cache some
other file earlier.  Possibly someone else's confidential file. 
Or a piece of some network package that was processed a while ago.

Helge Hafting