On Mon, 2026-03-02 at 18:44 -0500, Paul Moore wrote:

On Mon, Mar 2, 2026 at 3:25 PM Jeff Layton [off-list ref] wrote:

quoted

inode->i_ino is being widened from unsigned long to u64. The audit
subsystem uses unsigned long ino in struct fields, function parameters,
and local variables that store inode numbers from arbitrary filesystems.
On 32-bit platforms this truncates inode numbers that exceed 32 bits,
which will cause incorrect audit log entries and broken watch/mark
comparisons.

Widen all audit ino fields, parameters, and locals to u64, and update
the inode format string from %lu to %llu to match.

Signed-off-by: Jeff Layton <jlayton@kernel.org>
---
 include/linux/audit.h   | 2 +-
 kernel/audit.h          | 9 ++++-----
 kernel/audit_fsnotify.c | 4 ++--
 kernel/audit_watch.c    | 8 ++++----
 kernel/auditsc.c        | 2 +-
 5 files changed, 12 insertions(+), 13 deletions(-)

We should also update audit_hash_ino() in kernel/audit.h.  It is a
*very* basic hash function, so I think leaving the function as-is and
just changing the inode parameter from u32 to u64 should be fine.

It is indeed very simple. Here it is today:

	static inline int audit_hash_ino(u32 ino)                            
	{                                                                    
	        return (ino & (AUDIT_INODE_BUCKETS-1));                      
	}       

It doesn't look like changing the argument type will make any material
difference. Given that it should still work without that change, can we
leave this cleanup for you to do in a follow-on patchset?

-- 
Jeff Layton [off-list ref]