Re: [RFC] invalidate_mmap_range() misses remap_file_pages()-affected targets

[Andrew Morton <akpm@osdl.org>]

William Lee Irwin III <wli@holomorphy.com> wrote:
>
> invalidate_mmap_range(), and hence vmtruncate(), can miss its targets
>  due to remap_file_pages() disturbing the former invariant of file
>  offsets only being mapped within vmas tagged as mapping file offset
>  ranges containing them.

I was going to just not bother about this wart.  After all, we get to write
the standard on remap_file_pages(), and we can say "the
truncate-causes-SIGBUS thing doesn't work".  After all, it is not very
useful.

But I wonder if this effect could be used maliciously.  Say, user A has
read-only access to user B's file, and uses that access to set up a
nonlinear mapping thereby causing user B's truncate to not behave
correctly.  But this example is OK, isn't it?  User A will just receive an
anonymous page for his troubles.

Can you think of any stability or security scenario which says that we
_should_ implement the conventional truncate behaviour?