Re: [PATCH v3 02/12] audit: widen ino fields to u64

Paul Moore
2026-03-06T03:09:29Z

On Wed, Mar 4, 2026 at 10:33 AM Jeff Layton <jlayton@kernel.org> wrote:
>
> inode->i_ino is being widened from unsigned long to u64. The audit
> subsystem uses unsigned long ino in struct fields, function parameters,
> and local variables that store inode numbers from arbitrary filesystems.
> On 32-bit platforms this truncates inode numbers that exceed 32 bits,
> which will cause incorrect audit log entries and broken watch/mark
> comparisons.
>
> Widen all audit ino fields, parameters, and locals to u64, and update
> the inode format string from %lu to %llu to match.
>
> Signed-off-by: Jeff Layton <jlayton@kernel.org>
> ---
> include/linux/audit.h | 2 +-
> kernel/audit.h | 13 ++++++-------
> kernel/audit_fsnotify.c | 4 ++--
> kernel/audit_watch.c | 12 ++++++------
> kernel/auditsc.c | 4 ++--
> 5 files changed, 17 insertions(+), 18 deletions(-)

Acked-by: Paul Moore <paul@paul-moore.com>

--
paul-moore.com