[PATCH v3 7/7] mm/memfd_luo: fix integer overflow in memfd_luo_preserve_folios

Chenghao Duan
2026-03-26T08:53:11Z

In memfd_luo_preserve_folios(), two variables had types that could cause
silent data loss with large files:

1. 'size' was declared as 'long', truncating the 64-bit result of
i_size_read(). On 32-bit systems a 4GB file would be truncated to 0,
causing the function to return early and discard all data.

2. 'max_folios' was declared as 'unsigned int', causing overflow for
sparse files larger than 4TB. For example, a 16TB+4KB file would
calculate 0x100000001 folios but truncate to 1 when assigned to
max_folios, causing memfd_pin_folios() to pin only the first folio.

Fix by changing both variables to 'u64' to match the types returned
by i_size_read() and the folio count calculations.

This issue was identified by the AI review.
https://sashiko.dev/#/patchset/20260323110747.193569-1-duanchenghao@kylinos.cn

Signed-off-by: Chenghao Duan <duanchenghao@kylinos.cn>
---
mm/memfd_luo.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/mm/memfd_luo.c b/mm/memfd_luo.c
index f8e8f99b1848..4b4fa2f658d9 100644
--- a/mm/memfd_luo.c
+++ b/mm/memfd_luo.c
@@ -88,8 +88,8 @@ static int memfd_luo_preserve_folios(struct file *file,
{
struct inode *inode = file_inode(file);
struct memfd_luo_folio_ser *folios_ser;
- unsigned int max_folios;
- long i, size, nr_pinned;
+ u64 size, max_folios;
+ long i, nr_pinned;
struct folio **folios;
int err = -EINVAL;
pgoff_t offset;
--
2.25.1