Re: [PATCH 1/2] mm/vmalloc: fix 32-bit truncation of the area size in vread_iter()

[Andrew Morton]

On Sat, 25 Jul 2026 16:22:00 +0300 Artem Lytkin <iprintercanon@xxxxxxxxx> wrote:

> Commit 0bca23804632 ("mm/vmalloc: use physical page count in
> vread_iter() for VM_ALLOC areas") replaced get_vm_area_size(vm), which
> returns a size_t, with vm->nr_pages << PAGE_SHIFT.
> 
> struct vm_struct::nr_pages is an unsigned int. The shift operator does
> not perform the usual arithmetic conversions: the integer promotions are
> applied to each operand and the type of the result is that of the
> promoted left operand. The expression is therefore evaluated in 32-bit
> arithmetic no matter how PAGE_SHIFT is typed, and no matter that the
> result is assigned to a size_t. Once an area reaches 4 GiB the byte
> count wraps, at 1 << 20 pages with 4 KiB pages, 1 << 18 with 16 KiB and
> 1 << 16 with 64 KiB.
> 
> ...
> 
> Fix it by widening the shift, which also makes the expression consistent
> with the four (unsigned long)nr_pages << PAGE_SHIFT expressions in
> vrealloc_node_align_noprof().
> 
> On 32-bit a widening cast cannot help, size_t being 32 bits there as
> well, but a 4 GiB vmalloc area is not reachable on 32-bit either. On
> 64-bit the cast removes the truncation entirely, which is why replacing
> get_vm_area_size() introduced a regression rather than inheriting a
> pre-existing wart.
> 

Thanks.  AI review might have found a few things.  Most are
pre-existing but they are basically "more of the same thing", so you
may choose to address them?

	https://sashiko.dev/#/patchset/20260725132201.88279-1-iprintercanon@xxxxxxxxx

I wonder how much of this stuff would go away if we were to make
vm_struct.nr_pages an unsigned long?  It's already using 64 bits in the
CONFIG_HAVE_ARCH_HUGE_VMALLOC=n case.