Re: [PATCH v3 02/12] audit: widen ino fields to u64
From: Paul Moore <paul@paul-moore.com>
Date: 2026-03-06 03:09:25
Also in:
amd-gfx, autofs, bpf, ceph-devel, dri-devel, linux-bluetooth, linux-can, linux-cifs, linux-ext4, linux-f2fs-devel, linux-fscrypt, linux-fsdevel, linux-hams, linux-integrity, linux-media, linux-mm, linux-nfs, linux-perf-users, linux-sctp, linux-security-module, linux-trace-kernel, linux-unionfs, linux-xfs, lkml, netfs, ntfs3, nvdimm, ocfs2-devel, selinux, v9fs
On Wed, Mar 4, 2026 at 10:33 AM Jeff Layton [off-list ref] wrote:
inode->i_ino is being widened from unsigned long to u64. The audit subsystem uses unsigned long ino in struct fields, function parameters, and local variables that store inode numbers from arbitrary filesystems. On 32-bit platforms this truncates inode numbers that exceed 32 bits, which will cause incorrect audit log entries and broken watch/mark comparisons. Widen all audit ino fields, parameters, and locals to u64, and update the inode format string from %lu to %llu to match. Signed-off-by: Jeff Layton <jlayton@kernel.org> --- include/linux/audit.h | 2 +- kernel/audit.h | 13 ++++++------- kernel/audit_fsnotify.c | 4 ++-- kernel/audit_watch.c | 12 ++++++------ kernel/auditsc.c | 4 ++-- 5 files changed, 17 insertions(+), 18 deletions(-)
Acked-by: Paul Moore <paul@paul-moore.com> -- paul-moore.com