DF-2920 — beyond-EOF mmap fault enforcement missing (vfs_vm.c)

Unprivileged PoC proving that after a mid-block ftruncate(), VM pages beyond file EOF (retained for the last buffer cache buffer) can be re-faulted by userland: reads return data instead of SIGBUS, writes modify the last block, and during the truncate zero-fill window the pre-truncate contents are served (3.07M correlated observations/10s on tmpfs). On tmpfs, bytes written beyond EOF through such a mapping become file data after a later extend (trivial=1 extend skips the covering zero-fill).

Build (in guest)

./build.sh            # cc -O2 -pthread -o /tmp/truncfault truncfault.c

Run (as unprivileged user)

./run.sh /tmp/df2920.tmpfs.bin 8      # tmpfs
./run.sh /mnt/ufs/df2920.ufs.bin 8    # UFS (md/vn image)
./run.sh /home/maxx/df2920.h2.bin 8   # HAMMER2 root

Expected on a VULNERABLE kernel

S1 read @70000 (beyond EOF): value 0x00 served, NO SIGBUS
   read @200000 (beyond object): SIGBUS        <- contrast proves mechanism
S3 write @70000: SUCCEEDED; on tmpfs pread after extend returns 0x58
S4 WINDOW-HITS(pattern twice while small) > 0  (tmpfs: ~300k/10s)

Expected on a FIXED kernel (fix.diff applied)

All beyond-EOF probes SIGBUS; S3 write fails; S4 window hits 0.

Files

truncfault.c   probe (S0 sanity, S1/S2 reads, S3 write, S4 race)
run.tmpfs.log  baseline run on tmpfs (vulnerable kernel)
run.ufs.log    baseline run on UFS image (vn1)
run.h2.log     baseline run on HAMMER2 root
run.fixed.log  same probe on kernel patched with fix.diff
env.txt        guest uname / mounts
VERDICT.md     full narrative
fix.diff       git-apply-able fix (sys/vm/vm_fault.c)

DF-2920 — beyond-EOF mmap pages remain faultable after mid-block truncate

Verdict (baseline, stock kernel): REPRODUCED

File: sys/kern/vfs_vm.c (nvnode_pager_setsize(), called from nvtruncbuf()/nvextendbuf()) Class: improper access control / information disclosure window + memory-mapping semantics violation Impact: local info disclosure (racy) + deterministic integrity violation (writes beyond EOF become file data on tmpfs) Confidence: certain — deterministically reproduced on tmpfs, UFS and HAMMER2, unprivileged user, stock INVARIANTS kernel.

What the code intends

sys/kern/vfs_vm.c:42-47 states the design: pages beyond file EOF that still fit inside the last buffer cache buffer are kept (valid, part of the VMIO buffer) but "We simply unmap them and do not allow userland to fault them in." nvnode_pager_setsize() implements only the first half: a one-shot vm_page_protect(m, VM_PROT_NONE) unmap (sys/kern/vfs_vm.c:486-495). There is no second mechanism. The comment in sys/vm/vnode_pager.c:99 ("the VM fault code tests against v_filesize") is false: vm_fault_object() maps any present and fully valid page (sys/vm/vm_fault.c:1906-1968) with no EOF test whatsoever; the only size test (vm_fault.c:2015) compares against object->size, which deliberately covers the whole last buffer including pages beyond EOF (vfs_vm.c:463-466). The pager-side EOF test (vnode_pager_generic_getpages(), sys/vm/vnode_pager.c:505) is only reached for missing pages.

Proof (guest, unprivileged user maxx)

truncfault.c: file of 320 KiB filled with 0x5A, ftruncate() to 65536+1231 (mid-block for every blksize 4K..64K), then:

S3-tmpfs persistence mechanism: tmpfs_truncate() calls tmpfs_reg_resize(vp, length, 1) (sys/vfs/tmpfs/tmpfs_subr.c:1404) — trivial=1 even for ftruncate()-extends — so nvextendbuf() skips the zero-fill of the block straddling the old EOF (sys/kern/vfs_vm.c:386-408) and the bytes the user wrote beyond EOF through the (illegitimate) mapping become in-file data.

S4 window mechanism: nvtruncbuf() updates vp->v_filesize and unmaps beyond-EOF pages in nvnode_pager_setsize() before the zero-fill bzero(bp->b_data + boff, blksize - boff) runs (vfs_vm.c:165 vs vfs_vm.c:179-195). In that window any fault re-maps the retained valid page and serves the pre-truncate contents (0x5A) while fstat() already reports the smaller size — 3.07M correlated observations on tmpfs in 10 s. The window also exposes recycled disk-block content: when the last buffer is not cached, the truncate-time bread_kvabio() reads the whole block from disk — including the beyond-EOF tail, which on UFS/HAMMER2 contains residue of previously-deleted files — into the valid page before the bzero() erases it. The zero-fill is additionally skipped entirely by the NVEXTF_TRIVIAL path and by the bread error path (vfs_vm.c:196-201), leaving pre-truncate content exposed indefinitely.

Security impact

• Read side: an unprivileged user with read access to a file can read file contents beyond EOF (a) during the truncate window (proven), (b) permanently whenever the zero-fill is skipped (TRIVIAL / bread error), including on-disk residue of deleted files pulled in by the truncate-time bread. POSIX/SUSv require SIGBUS.
• Write side: an unprivileged user with write access can modify the last buffer beyond EOF through mappings created after the truncate; on tmpfs (trivial extend) those bytes become file content.
• The SIGBUS contract break also silently substitutes zeros where programs expect a fault, defeating "map generously, catch SIGBUS" bounds patterns.

Fix validation

Kernel rebuilt with fix.diff (vm_fault.c: reject faults beyond v_filesize for OBJT_VNODE first objects): see run.fixed.log. Baseline behavior on the same guest before the patch: run.*.log.