Messages in this thread Patch in this message |  | | From | Chenghao Duan <> | | Subject | [PATCH v3 7/7] mm/memfd_luo: fix integer overflow in memfd_luo_preserve_folios | | Date | Thu, 26 Mar 2026 16:47:27 +0800 |
| |
In memfd_luo_preserve_folios(), two variables had types that could cause silent data loss with large files:
1. 'size' was declared as 'long', truncating the 64-bit result of i_size_read(). On 32-bit systems a 4GB file would be truncated to 0, causing the function to return early and discard all data.
2. 'max_folios' was declared as 'unsigned int', causing overflow for sparse files larger than 4TB. For example, a 16TB+4KB file would calculate 0x100000001 folios but truncate to 1 when assigned to max_folios, causing memfd_pin_folios() to pin only the first folio.
Fix by changing both variables to 'u64' to match the types returned by i_size_read() and the folio count calculations.
This issue was identified by the AI review. https://sashiko.dev/#/patchset/20260323110747.193569-1-duanchenghao@kylinos.cn
Signed-off-by: Chenghao Duan <duanchenghao@kylinos.cn> --- mm/memfd_luo.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/mm/memfd_luo.c b/mm/memfd_luo.c index f8e8f99b1848..4b4fa2f658d9 100644 --- a/mm/memfd_luo.c +++ b/mm/memfd_luo.c @@ -88,8 +88,8 @@ static int memfd_luo_preserve_folios(struct file *file, { struct inode *inode = file_inode(file); struct memfd_luo_folio_ser *folios_ser; - unsigned int max_folios; - long i, size, nr_pinned; + u64 size, max_folios; + long i, nr_pinned; struct folio **folios; int err = -EINVAL; pgoff_t offset; -- 2.25.1
|  |