Re: [PATCH v2 003/110] audit: widen ino fields to u64
Paul Moore <[email protected]>
| Newsgroups | org.kernel.vger.audit,dev.linux.lists.fsverity,dev.linux.lists.netfs,dev.linux.lists.ntfs3,dev.linux.lists.nvdimm,dev.linux.lists.ocfs2-devel,dev.linux.lists.v9fs,net.sourceforge.lists.linux-f2fs-devel,org.freedesktop.lists.amd-gfx,org.freedesktop.lists.dri-devel,org.infradead.lists.linux-mtd,org.kernel.vger.autofs,org.kernel.vger.bpf,org.kernel.vger.ceph-devel,org.kernel.vger.ecryptfs,org.kernel.vger.linux-bluetooth,org.kernel.vger.linux-can,org.kernel.vger.linux-cifs,org.kernel.vger.linux-ext4,org.kernel.vger.linux-fscrypt,org.kernel.vger.linux-fsdevel,org.kernel.vger.linux-hams,org.kernel.vger.linux-integrity,org.kernel.vger.linux-kernel,org.kernel.vger.linux-media,org.kernel.vger.linux-nfs,org.kernel.vger.linux-nilfs,org.kernel.vger.linux-perf-users,org.kernel.vger.linux-sctp,org.kernel.vger.linux-security-module,org.kernel.vger.linux-trace-kernel,org.kernel.vger.linux-unionfs,org.kernel.vger.linux-x25,org.kernel.vger.linux-xfs,org.kernel.vger.netdev,org.kernel.vger.selinux,org.kvack.linux-mm |
|---|---|
| Message-ID | <CAHC9VhRnmBuXEKkUPQhJ_LDzcksjoAJL-ne6mFoJdR1hnDdzsg@mail.gmail.com> |
On Mon, Mar 2, 2026 at 3:25 PM Jeff Layton <[email protected]> wrote: > > inode->i_ino is being widened from unsigned long to u64. The audit > subsystem uses unsigned long ino in struct fields, function parameters, > and local variables that store inode numbers from arbitrary filesystems. > On 32-bit platforms this truncates inode numbers that exceed 32 bits, > which will cause incorrect audit log entries and broken watch/mark > comparisons. > > Widen all audit ino fields, parameters, and locals to u64, and update > the inode format string from %lu to %llu to match. > > Signed-off-by: Jeff Layton <[email protected]> > --- > include/linux/audit.h | 2 +- > kernel/audit.h | 9 ++++----- > kernel/audit_fsnotify.c | 4 ++-- > kernel/audit_watch.c | 8 ++++---- > kernel/auditsc.c | 2 +- > 5 files changed, 12 insertions(+), 13 deletions(-) We should also update audit_hash_ino() in kernel/audit.h. It is a *very* basic hash function, so I think leaving the function as-is and just changing the inode parameter from u32 to u64 should be fine. -- paul-moore.com