]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
mm/memfd_luo: reject memfds whose page count exceeds UINT_MAX
authorDavid Carlier <devnexen@gmail.com>
Thu, 23 Apr 2026 12:56:47 +0000 (13:56 +0100)
committerPasha Tatashin <pasha.tatashin@soleen.com>
Mon, 4 May 2026 14:03:15 +0000 (14:03 +0000)
commitd581fc99d3b958cb6e363104e9aab57f36aee6f3
treeaa2998192572599b7314dca4adfccc8d299c3c9f
parent0fb1daf0b78d0e23b63b6b65de56d4a3fd83bc14
mm/memfd_luo: reject memfds whose page count exceeds UINT_MAX

memfd_luo_preserve_folios() declares max_folios as unsigned int and
computes it from the inode size, then passes it to memfd_pin_folios()
which itself caps max_folios at unsigned int.  For files whose base-page
count exceeds UINT_MAX (larger than 16 TiB with 4 KiB pages), the
assignment truncates silently: only a prefix of the file gets pinned and
preserved, while memfd_luo_preserve() still records the full inode size
in ser->size.  On retrieve the inode is restored to the full size but
only the preserved prefix repopulates the page cache, so the tail comes
back as holes and user data is silently lost across the live update.

Reject such files at preserve time with -EFBIG rather than chunk the
pin loop, which would also require enlarging the preserved folios array
well beyond what is practical.

Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd")
Signed-off-by: David Carlier <devnexen@gmail.com>
Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com>
Reviewed-by: Pratyush Yadav <pratyush@kernel.org>
Link: https://patch.msgid.link/20260423125648.152113-1-devnexen@gmail.com
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
mm/memfd_luo.c