Re: [PATCH 1/2] mm/vmalloc: fix 32-bit truncation of the area size in vread_iter()

[Uladzislau Rezki]

On Sat, Jul 25, 2026 at 02:48:34PM -0700, Andrew Morton wrote:
> On Sat, 25 Jul 2026 16:22:00 +0300 Artem Lytkin <iprintercanon@xxxxxxxxx> wrote:
> 
> > Commit 0bca23804632 ("mm/vmalloc: use physical page count in
> > vread_iter() for VM_ALLOC areas") replaced get_vm_area_size(vm), which
> > returns a size_t, with vm->nr_pages << PAGE_SHIFT.
> > 
> > struct vm_struct::nr_pages is an unsigned int. The shift operator does
> > not perform the usual arithmetic conversions: the integer promotions are
> > applied to each operand and the type of the result is that of the
> > promoted left operand. The expression is therefore evaluated in 32-bit
> > arithmetic no matter how PAGE_SHIFT is typed, and no matter that the
> > result is assigned to a size_t. Once an area reaches 4 GiB the byte
> > count wraps, at 1 << 20 pages with 4 KiB pages, 1 << 18 with 16 KiB and
> > 1 << 16 with 64 KiB.
> > 
> > ...
> > 
> > Fix it by widening the shift, which also makes the expression consistent
> > with the four (unsigned long)nr_pages << PAGE_SHIFT expressions in
> > vrealloc_node_align_noprof().
> > 
> > On 32-bit a widening cast cannot help, size_t being 32 bits there as
> > well, but a 4 GiB vmalloc area is not reachable on 32-bit either. On
> > 64-bit the cast removes the truncation entirely, which is why replacing
> > get_vm_area_size() introduced a regression rather than inheriting a
> > pre-existing wart.
> > 
> 
> Thanks.  AI review might have found a few things.  Most are
> pre-existing but they are basically "more of the same thing", so you
> may choose to address them?
> 
> 	https://sashiko.dev/#/patchset/20260725132201.88279-1-iprintercanon@xxxxxxxxx
> 
> I wonder how much of this stuff would go away if we were to make
> vm_struct.nr_pages an unsigned long?  It's already using 64 bits in the
> CONFIG_HAVE_ARCH_HUGE_VMALLOC=n case.
>
I was thinking about it in same direction. Just to convert and get rid of
casting. It is safe.

--
Uladzislau Rezki