[lkml]   [2004]   [Sep]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: truncate shows non zero data beyond the end of the inode with MAP_SHARED
    Andrea Arcangeli wrote:

    >On Thu, Sep 16, 2004 at 10:49:33AM +0200, Helge Hafting wrote:
    >>Could this "garbage" possibly be confidential data?
    >I don't buy much in this theory.
    >>I.e. one user repeatedly makes and mmaps a 1-byte file,
    >>extends it to 4k, and looks at the 4095 bytes of "garbage".
    >>Maybe he finds some "interesting stuff" when someone else's
    >>confidential file just got dropped from pagecache
    >>so he could mmap this 1-byte file?
    >the old data got flushed below the i_size anyways, it sounds very
    >strange that confidential data is present only over the i_size and not
    >below the i_size, and if this guy has confidential data below the i_size
    >then it'd better memset the whole page. And in theory nobody should touch
    >the data over the i_size even if mmap allows to map it.
    I am not talking about someone accidentally stumbling onto
    something. I was worried about someone deliberately
    trying to exploit this - such people look at data above i_size
    _because they can_, hoping to find something interesting there.
    Something they cannot get at normally.

    I am assuming that the "garbage" between i_size and the
    page boundary is stuff left over from whatever that
    memory page was used for earlier? If so, it could be
    4095 bytes out of the 4096 that was used to cache some
    other file earlier. Possibly someone else's confidential file.
    Or a piece of some network package that was processed a while ago.

    Helge Hafting

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 14:06    [W:0.026 / U:13.028 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site