Re: [PATCH 01/15] hugetlbfs: fix integer overflow in fallocate()

[Muchun Song]

> On Oct 29, 2026, at 04:13, David Hildenbrand (Arm) <david@xxxxxxxxxx> wrote:
> 
> hugetlbfs_fallocate() rounds the range end up by adding hpage_size - 1
> to offset + len. vfs_fallocate()'s existing overflow check only makes
> sure that offset + len does not overflow.
> 
> Once we overflow for valid endpoints near LLONG_MAX, we can get a
> negative temporary result that is then converted to a very large
> huge page index.
> 
> A one-byte allocation ending at LLONG_MAX can therefore consume all
> available huge pages. Pages added beyond LLONG_MAX are skipped during
> inode eviction, leaking them and triggering the BUG_ON() in clear_inode().
> 
> To fix it, calculate the end index in a simpler way that cannot
> overflow. This also fixes the signed overflow reported by luojiajun in
> 2019.

Amazing that you remember something from so long ago!

> 
> Backporting notes: without commit a08c7193e4f18 ("mm/filemap: remove
> hugetlb special casing in filemap.c"), remove_inode_hugepages() must
> include the final huge page during truncate and eviction.
> 
> Reported-by: luojiajun <luojiajun3@xxxxxxxxxx>
> Closes: https://lore.kernel.org/all/1554775226-67213-1-git-send-email-luojiajun3@xxxxxxxxxx/
> Reported-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
> Fixes: 70c3547e36f5 ("hugetlbfs: add hugetlbfs_fallocate()")
> Cc: stable@xxxxxxxxxx
> Signed-off-by: David Hildenbrand (Arm) <david@xxxxxxxxxx>

LGTM.

Acked-by: Muchun Song <muchun.song@xxxxxxxxx>

Thanks.