Re: [PATCH v3 1/1] mm: shmem: reject page-aligned fallocate end overflow

On Fri, 31 Jul 2026 11:22:51 +0800 Zhiling Zou <[email protected]> wrote:

> shmem_fallocate() validates offset + len with inode_newsize_ok(), but
> then rounds that end offset up to a page boundary before entering the
> preallocation loop.
> 
> For a valid request ending at MAX_LFS_FILESIZE, such as offset = 0 and
> len = LLONG_MAX, adding PAGE_SIZE - 1 to the validated end can overflow
> the signed loff_t used for the rounded end calculation. If that wrapped
> value is then converted into a page index, shmem_fallocate() can enter
> the folio allocation loop with an invalid range.
> 
> Use check_add_overflow() when calculating the page-aligned end, and fail
> before entering the allocation loop if the rounded end cannot be
> represented.
> 

Thanks.

> --- a/mm/shmem.c
> +++ b/mm/shmem.c
> @@ -3602,6 +3602,7 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
>  	struct shmem_inode_info *info = SHMEM_I(inode);
>  	struct shmem_falloc shmem_falloc;
>  	pgoff_t start, index, end, undo_fallocend;
> +	loff_t aligned_end;
>  	int error;
>  
>  	if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE))
> @@ -3658,8 +3659,15 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
>  		goto out;
>  	}
>  
> +	/* Check for wraparound */
> +	if (check_add_overflow(offset + len, (loff_t)PAGE_SIZE - 1,
> +			       &aligned_end)) {
> +		error = -EFBIG;
> +		goto out;
> +	}

AI review suggests that there could be a new overflow condition here.

And it might have found a pre-existing underflow.

	https://sashiko.dev/#/patchset/1929a466735dcbb9438936ff50b7a4fc2332a8a4.1785377919.git.zhilinz@nebusec.ai