[PATCH v2 1/1] mm: shmem: reject page-aligned fallocate end overflow

[PATCH v2 1/1] mm: shmem: reject page-aligned fallocate end overflow

[Zhiling Zou]

shmem_fallocate() validates offset + len with inode_newsize_ok(), but
then rounds that end offset up to a page boundary before entering the
preallocation loop.

For a valid request ending at MAX_LFS_FILESIZE, such as offset = 0 and
len = LLONG_MAX, adding PAGE_SIZE - 1 to the validated end can overflow
the signed loff_t used for the rounded end calculation. If that wrapped
value is then converted into a page index, shmem_fallocate() can enter
the folio allocation loop with an invalid range.

Cache the already validated end position, use check_add_overflow() when
rounding it up to a page-aligned byte offset, and reuse the cached end
for the later seal, shmem_get_folio(), and i_size checks.

Fixes: e2d12e22c59c ("tmpfs: support fallocate preallocation")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
---
changes in v2:
- drop the RAM/swap-based range rejection
- drop the NORESERVE full-range accounting probe
- use check_add_overflow() on a signed loff_t rounded end
- v1 Link: https://lore.kernel.org/all/adcf644e780706c220809b7a41e6e496d2181806.1784947149.git.zhilinz@nebusec.ai/

 mm/shmem.c | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/mm/shmem.c b/mm/shmem.c
index b51f83c970bb3..f4648545e7ae7 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -3602,6 +3602,8 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
 	struct shmem_inode_info *info = SHMEM_I(inode);
 	struct shmem_falloc shmem_falloc;
 	pgoff_t start, index, end, undo_fallocend;
+	loff_t end_byte;
+	loff_t end_pos;
 	int error;
 
 	if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE))
@@ -3649,23 +3651,28 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
 	}
 
 	/* We need to check rlimit even when FALLOC_FL_KEEP_SIZE */
-	error = inode_newsize_ok(inode, offset + len);
+	end_pos = offset + len;
+	error = inode_newsize_ok(inode, end_pos);
 	if (error)
 		goto out;
 
-	if ((info->seals & F_SEAL_GROW) && offset + len > inode->i_size) {
+	if ((info->seals & F_SEAL_GROW) && end_pos > inode->i_size) {
 		error = -EPERM;
 		goto out;
 	}
 
+	if (check_add_overflow(end_pos, (loff_t)PAGE_SIZE - 1, &end_byte)) {
+		error = -EFBIG;
+		goto out;
+	}
+
 	start = offset >> PAGE_SHIFT;
-	end = (offset + len + PAGE_SIZE - 1) >> PAGE_SHIFT;
+	end = (u64)end_byte >> PAGE_SHIFT;
 	/* Try to avoid a swapstorm if len is impossible to satisfy */
 	if (sbinfo->max_blocks && end - start > sbinfo->max_blocks) {
 		error = -ENOSPC;
 		goto out;
 	}
-
 	shmem_falloc.waitq = NULL;
 	shmem_falloc.start = start;
 	shmem_falloc.next  = start;
@@ -3699,7 +3706,7 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
 		else if (shmem_falloc.nr_unswapped > shmem_falloc.nr_falloced)
 			error = -ENOMEM;
 		else
-			error = shmem_get_folio(inode, index, offset + len,
+			error = shmem_get_folio(inode, index, end_pos,
 						&folio, SGP_FALLOC);
 		if (error) {
 			info->fallocend = undo_fallocend;
@@ -3743,8 +3750,8 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
 		cond_resched();
 	}
 
-	if (!(mode & FALLOC_FL_KEEP_SIZE) && offset + len > inode->i_size)
-		i_size_write(inode, offset + len);
+	if (!(mode & FALLOC_FL_KEEP_SIZE) && end_pos > inode->i_size)
+		i_size_write(inode, end_pos);
 undone:
 	spin_lock(&inode->i_lock);
 	inode->i_private = NULL;
-- 
2.43.0

Re: [PATCH v2 1/1] mm: shmem: reject page-aligned fallocate end overflow

[Andrew Morton]

On Wed, 29 Jul 2026 22:07:30 +0800 Zhiling Zou <zhilinz@nebusec.ai> wrote:

> shmem_fallocate() validates offset + len with inode_newsize_ok(), but
> then rounds that end offset up to a page boundary before entering the
> preallocation loop.
> 
> For a valid request ending at MAX_LFS_FILESIZE, such as offset = 0 and
> len = LLONG_MAX, adding PAGE_SIZE - 1 to the validated end can overflow
> the signed loff_t used for the rounded end calculation. If that wrapped
> value is then converted into a page index, shmem_fallocate() can enter
> the folio allocation loop with an invalid range.
> 
> Cache the already validated end position, use check_add_overflow() when
> rounding it up to a page-aligned byte offset, and reuse the cached end
> for the later seal, shmem_get_folio(), and i_size checks.

Thanks.

AI review:
	https://sashiko.dev/#/patchset/87a63846fe9873b1e26e8a7dcafcb21aa8d709fa.1785309651.git.zhilinz@nebusec.ai

Suggests there's a flaw in your change.  And it does appear to have
found a significant pre-existing bug in there.  Can you please take a
look?