Messages in this thread |  | | From | Pasha Tatashin <> | | Date | Wed, 1 Apr 2026 21:39:35 -0400 | | Subject | Re: [PATCH v3 7/7] mm/memfd_luo: fix integer overflow in memfd_luo_preserve_folios |
| |
On Thu, Mar 26, 2026 at 4:48 AM Chenghao Duan <duanchenghao@kylinos.cn> wrote: > > In memfd_luo_preserve_folios(), two variables had types that could cause > silent data loss with large files: > > 1. 'size' was declared as 'long', truncating the 64-bit result of > i_size_read(). On 32-bit systems a 4GB file would be truncated to 0,
This is not an issue, KHO only supports 64-bit systems, but using the correct type is a good idea anyway.
> causing the function to return early and discard all data. > > 2. 'max_folios' was declared as 'unsigned int', causing overflow for > sparse files larger than 4TB. For example, a 16TB+4KB file would > calculate 0x100000001 folios but truncate to 1 when assigned to > max_folios, causing memfd_pin_folios() to pin only the first folio. > > Fix by changing both variables to 'u64' to match the types returned > by i_size_read() and the folio count calculations.
Strictly speaking, i_size_read() returns loff_t which is 'long long', so s64 not u64, but anyways u64 works here.
Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com>
|  |