linux-kernel - Re: Partialy mapped page stays in page cache after unmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20121031141903.GA23341@rei.suse.cz>
Date:	Wed, 31 Oct 2012 15:19:03 +0100
From:	chrubis@...e.cz
To:	Bob Liu <lliubbo@...il.com>
Cc:	linux-kernel@...r.kernel.org, linux-mm@...ck.org,
	Hugh Dickins <hughd@...gle.com>,
	Michel Lespinasse <walken@...gle.com>,
	Ingo Molnar <mingo@...nel.org>,
	Al Viro <viro@...iv.linux.org.uk>,
	Andrew Morton <akpm@...ux-foundation.org>,
	"Michael Kerrisk (man-pages)" <mtk.manpages@...il.com>
Subject: Re: Partialy mapped page stays in page cache after unmap

Hi!
> > Strictly speaking this is not a bug at least when sticking to regular
> > files as POSIX which says that the change is not written out. In this
> > case the file content is correct and forcing the data to be written out
> > by msync() makes the test pass. The SHM mappings seems to preserve the
> > content even after calling msync() which is, in my opinion, POSIX
> > violation although a minor one.
> >
> 
> fsync implemented in SHM is noop_fsync.
> May be we should extend it if needed.

I'm entirely sure that would fix the interface correclty. The posix
says:

mmap:

...
The system shall always zero-fill any partial page at the end of an
object. Further, the system shall never write out any modified portions
of the last page of an object which are beyond its end. 
...

msync:

...
The effect of msync() on a shared memory object or a typed memory object
is unspecified. 
...

Hmm, that is a little confusing and it looks like it depends on
interpretation what 'write out' for SHM object means. And I guess that
leaving the SHM part as it is is reasonable. Maybe worth of a note in
manual page.

On the other hand there seems to be several bugs in mmap() on regular
files. For example mapping half of the page from a file doesn't fill the
rest of the page with zeroes. And it looks like when half of page is
mapped, the second half modified, then unmapped and then the whole page
is mapped the content doesn't seem to be right, although this seems to
change randomly. The reproducer for the first case attached.

-- 
Cyril Hrubis
chrubis@...e.cz

View attachment "reproducer1.c" of type "text/x-c" (1317 bytes)