[PATCH v2 1/1] mm: shmem: reject page-aligned fallocate end overflow

[PATCH v2 1/1] mm: shmem: reject page-aligned fallocate end overflow

[Zhiling Zou]

shmem_fallocate() validates offset + len with inode_newsize_ok(), but
then rounds that end offset up to a page boundary before entering the
preallocation loop.

For a valid request ending at MAX_LFS_FILESIZE, such as offset = 0 and
len = LLONG_MAX, adding PAGE_SIZE - 1 to the validated end can overflow
the signed loff_t used for the rounded end calculation. If that wrapped
value is then converted into a page index, shmem_fallocate() can enter
the folio allocation loop with an invalid range.

Cache the already validated end position, use check_add_overflow() when
rounding it up to a page-aligned byte offset, and reuse the cached end
for the later seal, shmem_get_folio(), and i_size checks.

Fixes: e2d12e22c59c ("tmpfs: support fallocate preallocation")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
---
changes in v2:
- drop the RAM/swap-based range rejection
- drop the NORESERVE full-range accounting probe
- use check_add_overflow() on a signed loff_t rounded end
- v1 Link: https://lore.kernel.org/all/adcf644e780706c220809b7a41e6e496d2181806.1784947149.git.zhilinz@nebusec.ai/

 mm/shmem.c | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/mm/shmem.c b/mm/shmem.c
index b51f83c970bb3..f4648545e7ae7 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -3602,6 +3602,8 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
 	struct shmem_inode_info *info = SHMEM_I(inode);
 	struct shmem_falloc shmem_falloc;
 	pgoff_t start, index, end, undo_fallocend;
+	loff_t end_byte;
+	loff_t end_pos;
 	int error;
 
 	if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE))
@@ -3649,23 +3651,28 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
 	}
 
 	/* We need to check rlimit even when FALLOC_FL_KEEP_SIZE */
-	error = inode_newsize_ok(inode, offset + len);
+	end_pos = offset + len;
+	error = inode_newsize_ok(inode, end_pos);
 	if (error)
 		goto out;
 
-	if ((info->seals & F_SEAL_GROW) && offset + len > inode->i_size) {
+	if ((info->seals & F_SEAL_GROW) && end_pos > inode->i_size) {
 		error = -EPERM;
 		goto out;
 	}
 
+	if (check_add_overflow(end_pos, (loff_t)PAGE_SIZE - 1, &end_byte)) {
+		error = -EFBIG;
+		goto out;
+	}
+
 	start = offset >> PAGE_SHIFT;
-	end = (offset + len + PAGE_SIZE - 1) >> PAGE_SHIFT;
+	end = (u64)end_byte >> PAGE_SHIFT;
 	/* Try to avoid a swapstorm if len is impossible to satisfy */
 	if (sbinfo->max_blocks && end - start > sbinfo->max_blocks) {
 		error = -ENOSPC;
 		goto out;
 	}
-
 	shmem_falloc.waitq = NULL;
 	shmem_falloc.start = start;
 	shmem_falloc.next  = start;
@@ -3699,7 +3706,7 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
 		else if (shmem_falloc.nr_unswapped > shmem_falloc.nr_falloced)
 			error = -ENOMEM;
 		else
-			error = shmem_get_folio(inode, index, offset + len,
+			error = shmem_get_folio(inode, index, end_pos,
 						&folio, SGP_FALLOC);
 		if (error) {
 			info->fallocend = undo_fallocend;
@@ -3743,8 +3750,8 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
 		cond_resched();
 	}
 
-	if (!(mode & FALLOC_FL_KEEP_SIZE) && offset + len > inode->i_size)
-		i_size_write(inode, offset + len);
+	if (!(mode & FALLOC_FL_KEEP_SIZE) && end_pos > inode->i_size)
+		i_size_write(inode, end_pos);
 undone:
 	spin_lock(&inode->i_lock);
 	inode->i_private = NULL;
-- 
2.43.0

Re: [PATCH v2 1/1] mm: shmem: reject page-aligned fallocate end overflow

[Andrew Morton]

On Wed, 29 Jul 2026 22:07:30 +0800 Zhiling Zou <zhilinz@nebusec.ai> wrote:

> shmem_fallocate() validates offset + len with inode_newsize_ok(), but
> then rounds that end offset up to a page boundary before entering the
> preallocation loop.
> 
> For a valid request ending at MAX_LFS_FILESIZE, such as offset = 0 and
> len = LLONG_MAX, adding PAGE_SIZE - 1 to the validated end can overflow
> the signed loff_t used for the rounded end calculation. If that wrapped
> value is then converted into a page index, shmem_fallocate() can enter
> the folio allocation loop with an invalid range.
> 
> Cache the already validated end position, use check_add_overflow() when
> rounding it up to a page-aligned byte offset, and reuse the cached end
> for the later seal, shmem_get_folio(), and i_size checks.

Thanks.

AI review:
	https://sashiko.dev/#/patchset/87a63846fe9873b1e26e8a7dcafcb21aa8d709fa.1785309651.git.zhilinz@nebusec.ai

Suggests there's a flaw in your change.  And it does appear to have
found a significant pre-existing bug in there.  Can you please take a
look?

Re: [PATCH v2 1/1] mm: shmem: reject page-aligned fallocate end overflow

[Baolin Wang]

On 7/29/26 10:07 PM, Zhiling Zou wrote:
> shmem_fallocate() validates offset + len with inode_newsize_ok(), but
> then rounds that end offset up to a page boundary before entering the
> preallocation loop.
> 
> For a valid request ending at MAX_LFS_FILESIZE, such as offset = 0 and
> len = LLONG_MAX, adding PAGE_SIZE - 1 to the validated end can overflow
> the signed loff_t used for the rounded end calculation. If that wrapped
> value is then converted into a page index, shmem_fallocate() can enter
> the folio allocation loop with an invalid range.
> 
> Cache the already validated end position, use check_add_overflow() when
> rounding it up to a page-aligned byte offset, and reuse the cached end
> for the later seal, shmem_get_folio(), and i_size checks.
> 
> Fixes: e2d12e22c59c ("tmpfs: support fallocate preallocation")
> Cc: stable@vger.kernel.org

I don't think this needs CC stable, since this is not a common case. We 
never hit this issue in products

> Reported-by: Vega <vega@nebusec.ai>
> Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
> ---
> changes in v2:
> - drop the RAM/swap-based range rejection
> - drop the NORESERVE full-range accounting probe
> - use check_add_overflow() on a signed loff_t rounded end
> - v1 Link: https://lore.kernel.org/all/adcf644e780706c220809b7a41e6e496d2181806.1784947149.git.zhilinz@nebusec.ai/
> 
>   mm/shmem.c | 21 ++++++++++++++-------
>   1 file changed, 14 insertions(+), 7 deletions(-)
> 
> diff --git a/mm/shmem.c b/mm/shmem.c
> index b51f83c970bb3..f4648545e7ae7 100644
> --- a/mm/shmem.c
> +++ b/mm/shmem.c
> @@ -3602,6 +3602,8 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
>   	struct shmem_inode_info *info = SHMEM_I(inode);
>   	struct shmem_falloc shmem_falloc;
>   	pgoff_t start, index, end, undo_fallocend;
> +	loff_t end_byte;
> +	loff_t end_pos;
>   	int error;

Too many unnecessary changes. I'd expect something like:

diff --git a/mm/shmem.c b/mm/shmem.c
index 6641823bed16..cc7b17d0111e 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -3624,6 +3624,7 @@ static long shmem_fallocate(struct file *file, int 
mode, loff_t offset,
         struct shmem_inode_info *info = SHMEM_I(inode);
         struct shmem_falloc shmem_falloc;
         pgoff_t start, index, end, undo_fallocend;
+       loff_t aligned_end;
         int error;

         if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE))
@@ -3680,8 +3681,14 @@ static long shmem_fallocate(struct file *file, 
int mode, loff_t offset,
                 goto out;
         }

+       /* Check for wraparound */
+       if (check_add_overflow(offset + len, (loff_t)PAGE_SIZE - 1, 
&aligned_end)) {
+               error = -EFBIG;
+               goto out;
+       }
+
         start = offset >> PAGE_SHIFT;
-       end = (offset + len + PAGE_SIZE - 1) >> PAGE_SHIFT;
+       end = aligned_end >> PAGE_SHIFT;
         /* Try to avoid a swapstorm if len is impossible to satisfy */
         if (sbinfo->max_blocks && end - start > sbinfo->max_blocks) {
                 error = -ENOSPC;

>   
>   	if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE))
> @@ -3649,23 +3651,28 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
>   	}
>   
>   	/* We need to check rlimit even when FALLOC_FL_KEEP_SIZE */
> -	error = inode_newsize_ok(inode, offset + len);
> +	end_pos = offset + len;
> +	error = inode_newsize_ok(inode, end_pos);
>   	if (error)
>   		goto out;
>   
> -	if ((info->seals & F_SEAL_GROW) && offset + len > inode->i_size) {
> +	if ((info->seals & F_SEAL_GROW) && end_pos > inode->i_size) {
>   		error = -EPERM;
>   		goto out;
>   	}
>   
> +	if (check_add_overflow(end_pos, (loff_t)PAGE_SIZE - 1, &end_byte)) {
> +		error = -EFBIG;
> +		goto out;
> +	}
> +
>   	start = offset >> PAGE_SHIFT;
> -	end = (offset + len + PAGE_SIZE - 1) >> PAGE_SHIFT;
> +	end = (u64)end_byte >> PAGE_SHIFT;
>   	/* Try to avoid a swapstorm if len is impossible to satisfy */
>   	if (sbinfo->max_blocks && end - start > sbinfo->max_blocks) {
>   		error = -ENOSPC;
>   		goto out;
>   	}
> -
>   	shmem_falloc.waitq = NULL;
>   	shmem_falloc.start = start;
>   	shmem_falloc.next  = start;
> @@ -3699,7 +3706,7 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
>   		else if (shmem_falloc.nr_unswapped > shmem_falloc.nr_falloced)
>   			error = -ENOMEM;
>   		else
> -			error = shmem_get_folio(inode, index, offset + len,
> +			error = shmem_get_folio(inode, index, end_pos,
>   						&folio, SGP_FALLOC);
>   		if (error) {
>   			info->fallocend = undo_fallocend;
> @@ -3743,8 +3750,8 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
>   		cond_resched();
>   	}
>   
> -	if (!(mode & FALLOC_FL_KEEP_SIZE) && offset + len > inode->i_size)
> -		i_size_write(inode, offset + len);
> +	if (!(mode & FALLOC_FL_KEEP_SIZE) && end_pos > inode->i_size)
> +		i_size_write(inode, end_pos);
>   undone:
>   	spin_lock(&inode->i_lock);
>   	inode->i_private = NULL;

Re: [PATCH v2 1/1] mm: shmem: reject page-aligned fallocate end overflow

[zhilin zou]

On Thu, Jul 30, 2026 at 10:02 AM Baolin Wang
<baolin.wang@linux.alibaba.com> wrote:
>
>
>
> On 7/29/26 10:07 PM, Zhiling Zou wrote:
> > shmem_fallocate() validates offset + len with inode_newsize_ok(), but
> > then rounds that end offset up to a page boundary before entering the
> > preallocation loop.
> >
> > For a valid request ending at MAX_LFS_FILESIZE, such as offset = 0 and
> > len = LLONG_MAX, adding PAGE_SIZE - 1 to the validated end can overflow
> > the signed loff_t used for the rounded end calculation. If that wrapped
> > value is then converted into a page index, shmem_fallocate() can enter
> > the folio allocation loop with an invalid range.
> >
> > Cache the already validated end position, use check_add_overflow() when
> > rounding it up to a page-aligned byte offset, and reuse the cached end
> > for the later seal, shmem_get_folio(), and i_size checks.
> >
> > Fixes: e2d12e22c59c ("tmpfs: support fallocate preallocation")
> > Cc: stable@vger.kernel.org
>
> I don't think this needs CC stable, since this is not a common case. We
> never hit this issue in products
>
> > Reported-by: Vega <vega@nebusec.ai>
> > Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
> > ---
> > changes in v2:
> > - drop the RAM/swap-based range rejection
> > - drop the NORESERVE full-range accounting probe
> > - use check_add_overflow() on a signed loff_t rounded end
> > - v1 Link: https://lore.kernel.org/all/adcf644e780706c220809b7a41e6e496d2181806.1784947149.git.zhilinz@nebusec.ai/
> >
> >   mm/shmem.c | 21 ++++++++++++++-------
> >   1 file changed, 14 insertions(+), 7 deletions(-)
> >
> > diff --git a/mm/shmem.c b/mm/shmem.c
> > index b51f83c970bb3..f4648545e7ae7 100644
> > --- a/mm/shmem.c
> > +++ b/mm/shmem.c
> > @@ -3602,6 +3602,8 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
> >       struct shmem_inode_info *info = SHMEM_I(inode);
> >       struct shmem_falloc shmem_falloc;
> >       pgoff_t start, index, end, undo_fallocend;
> > +     loff_t end_byte;
> > +     loff_t end_pos;
> >       int error;
>
> Too many unnecessary changes. I'd expect something like:
>
> diff --git a/mm/shmem.c b/mm/shmem.c
> index 6641823bed16..cc7b17d0111e 100644
> --- a/mm/shmem.c
> +++ b/mm/shmem.c
> @@ -3624,6 +3624,7 @@ static long shmem_fallocate(struct file *file, int
> mode, loff_t offset,
>          struct shmem_inode_info *info = SHMEM_I(inode);
>          struct shmem_falloc shmem_falloc;
>          pgoff_t start, index, end, undo_fallocend;
> +       loff_t aligned_end;
>          int error;
>
>          if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE))
> @@ -3680,8 +3681,14 @@ static long shmem_fallocate(struct file *file,
> int mode, loff_t offset,
>                  goto out;
>          }
>
> +       /* Check for wraparound */
> +       if (check_add_overflow(offset + len, (loff_t)PAGE_SIZE - 1,
> &aligned_end)) {
> +               error = -EFBIG;
> +               goto out;
> +       }
> +
>          start = offset >> PAGE_SHIFT;
> -       end = (offset + len + PAGE_SIZE - 1) >> PAGE_SHIFT;
> +       end = aligned_end >> PAGE_SHIFT;
>          /* Try to avoid a swapstorm if len is impossible to satisfy */
>          if (sbinfo->max_blocks && end - start > sbinfo->max_blocks) {
>                  error = -ENOSPC;
>
> >
> >       if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE))
> > @@ -3649,23 +3651,28 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
> >       }
> >
> >       /* We need to check rlimit even when FALLOC_FL_KEEP_SIZE */
> > -     error = inode_newsize_ok(inode, offset + len);
> > +     end_pos = offset + len;
> > +     error = inode_newsize_ok(inode, end_pos);
> >       if (error)
> >               goto out;
> >
> > -     if ((info->seals & F_SEAL_GROW) && offset + len > inode->i_size) {
> > +     if ((info->seals & F_SEAL_GROW) && end_pos > inode->i_size) {
> >               error = -EPERM;
> >               goto out;
> >       }
> >
> > +     if (check_add_overflow(end_pos, (loff_t)PAGE_SIZE - 1, &end_byte)) {
> > +             error = -EFBIG;
> > +             goto out;
> > +     }
> > +
> >       start = offset >> PAGE_SHIFT;
> > -     end = (offset + len + PAGE_SIZE - 1) >> PAGE_SHIFT;
> > +     end = (u64)end_byte >> PAGE_SHIFT;
> >       /* Try to avoid a swapstorm if len is impossible to satisfy */
> >       if (sbinfo->max_blocks && end - start > sbinfo->max_blocks) {
> >               error = -ENOSPC;
> >               goto out;
> >       }
> > -
> >       shmem_falloc.waitq = NULL;
> >       shmem_falloc.start = start;
> >       shmem_falloc.next  = start;
> > @@ -3699,7 +3706,7 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
> >               else if (shmem_falloc.nr_unswapped > shmem_falloc.nr_falloced)
> >                       error = -ENOMEM;
> >               else
> > -                     error = shmem_get_folio(inode, index, offset + len,
> > +                     error = shmem_get_folio(inode, index, end_pos,
> >                                               &folio, SGP_FALLOC);
> >               if (error) {
> >                       info->fallocend = undo_fallocend;
> > @@ -3743,8 +3750,8 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
> >               cond_resched();
> >       }
> >
> > -     if (!(mode & FALLOC_FL_KEEP_SIZE) && offset + len > inode->i_size)
> > -             i_size_write(inode, offset + len);
> > +     if (!(mode & FALLOC_FL_KEEP_SIZE) && end_pos > inode->i_size)
> > +             i_size_write(inode, end_pos);
> >   undone:
> >       spin_lock(&inode->i_lock);
> >       inode->i_private = NULL;
>

Thanks Andrew and Baolin.

Baolin, agreed. I will drop the stable Cc and simplify the patch to only
guard the page-aligned end calculation, as suggested.

Andrew, I checked the Sashiko report. The concern about this patch
affecting punch-hole requests does not apply, since the punch-hole path
returns before the new check. The small-range punch-hole unmap case looks
like a separate pre-existing issue, so I will keep it separate from this
minimal overflow fix.

I will send v3 shortly.