linux-kernel - truncate on MAP_SHARED files in ramfs filesystems on no-mmu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <8bd0f97a0907090104h5d4984dfkbeb82616a01128c8@mail.gmail.com>
Date:	Thu, 9 Jul 2009 04:04:31 -0400
From:	Mike Frysinger <vapier.adi@...il.com>
To:	David Howells <dhowells@...hat.com>
Cc:	Linux kernel mailing list <linux-kernel@...r.kernel.org>
Subject: truncate on MAP_SHARED files in ramfs filesystems on no-mmu

reviewing LTP tests shows mmap09 failing.  this test creates a file of
a certain length, opens it and creates a shared mapping, and then
tries various truncate tests:
truncate to a smaller size
truncate to a larger size
truncate to size 0

the first and last fail on no-mmu due to
file-nommu.c:ramfs_nommu_resize() rejecting attempts to shrink on a
shared mapping:
    /* check that a decrease in size doesn't cut off any shared mappings */
    if (newsize < size) {
        ret = ramfs_nommu_check_mappings(inode, newsize, size);
        if (ret < 0)
            return ret;
    }

my question is why ?  if an application maps a fd with MAP_SHARED,
truncates it, and then it or someone else who has that fd mapped tries
to access the now-invalid tail end, that is a bug in the application.
i dont see why we should be protecting users here from their own buggy
code ?
-mike
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/