From 1dcf2be94b9be2d366a0d2b70c2b1c7ebccf1443 Mon Sep 17 00:00:00 2001 From: Avi Weiss Date: Thu, 15 Oct 2026 20:57:01 +0300 Subject: [PATCH 1/2] fsnotify: preserve 64-bit pre-content ranges vfs_fallocate() and remap_verify_area() pass 64-bit lengths to fsnotify_file_area_perm(), which truncates them to size_t on 32-bit systems. Use 64 bit (unsigned) types throughout the entire pre-content notification chain to keep the full range. The userspace range field is already 64-bits. Fixes: 9740d17162de ("fsnotify: pass optional file access range in pre-content event") Signed-off-by: Avi Weiss Link: https://patch.msgid.link/20261015175701.3674449-1-thnkslprpt@gmail.com Signed-off-by: Jan Kara --- fs/notify/fanotify/fanotify.h | 2 +- fs/notify/fsnotify.c | 2 +- include/linux/fsnotify.h | 4 ++-- include/linux/fsnotify_backend.h | 6 +++--- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/fs/notify/fanotify/fanotify.h b/fs/notify/fanotify/fanotify.h index 87ba788574bf..c25cf5c1fc70 100644 --- a/fs/notify/fanotify/fanotify.h +++ b/fs/notify/fanotify/fanotify.h @@ -444,7 +444,7 @@ struct fanotify_perm_event { struct fanotify_event fae; struct path path; loff_t pos; /* FANOTIFY_NO_RANGE if unavailable */ - size_t count; + u64 count; u32 response; /* userspace answer to the event */ unsigned short state; /* state of the event */ unsigned short watchdog_cnt; /* already scanned by watchdog? */ diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c index 7e2f330fd283..8657bb94dfa8 100644 --- a/fs/notify/fsnotify.c +++ b/fs/notify/fsnotify.c @@ -157,7 +157,7 @@ static inline __u32 fsnotify_object_watched(struct inode *inode, __u32 mnt_mask, /* Report pre-content event with optional range info */ int fsnotify_pre_content(const struct path *path, const loff_t *ppos, - size_t count) + u64 count) { struct file_range range; diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h index bda798bc67bc..a4a29b365008 100644 --- a/include/linux/fsnotify.h +++ b/include/linux/fsnotify.h @@ -135,7 +135,7 @@ int fsnotify_open_perm_and_set_mode(struct file *file); * fsnotify_file_area_perm - permission hook before access to file range */ static inline int fsnotify_file_area_perm(struct file *file, int perm_mask, - const loff_t *ppos, size_t count) + const loff_t *ppos, u64 count) { /* * filesystem may be modified in the context of permission events @@ -213,7 +213,7 @@ static inline int fsnotify_open_perm_and_set_mode(struct file *file) } static inline int fsnotify_file_area_perm(struct file *file, int perm_mask, - const loff_t *ppos, size_t count) + const loff_t *ppos, u64 count) { return 0; } diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h index a6d5c1a89cff..faf21564380d 100644 --- a/include/linux/fsnotify_backend.h +++ b/include/linux/fsnotify_backend.h @@ -323,7 +323,7 @@ struct fs_error_report { struct file_range { const struct path *path; loff_t pos; - size_t count; + u64 count; }; static inline const struct path *file_range_path(const struct file_range *range) @@ -946,12 +946,12 @@ static inline void fsnotify_init_event(struct fsnotify_event *event) INIT_LIST_HEAD(&event->list); } int fsnotify_pre_content(const struct path *path, const loff_t *ppos, - size_t count); + u64 count); #else static inline int fsnotify_pre_content(const struct path *path, - const loff_t *ppos, size_t count) + const loff_t *ppos, u64 count) { return 0; } From 581230d2ec3c0380917d1255792508851e7c4627 Mon Sep 17 00:00:00 2001 From: Hungyu Lin Date: Tue, 27 Oct 2026 19:20:27 +0000 Subject: [PATCH 2/2] inotify: do not coalesce rename events inotify compares the mask, watch descriptor and name when coalescing adjacent unread events, but ignores their rename cookies. Distinct IN_MOVED_FROM events can therefore be coalesced, losing the cookie needed to match a later IN_MOVED_TO event. For example, watch two directories with IN_MOVE. Move an entry from the first directory into an unwatched directory, recreate it under the same name, then move it from the first directory into the second watched directory before reading the events. The second IN_MOVED_FROM is merged with the first, while the IN_MOVED_TO retains the second rename's cookie. Userspace can no longer pair the second rename's events. The original inotify implementation compared cookies before coalescing. The fsnotify conversion lost this comparison. Do not coalesce IN_MOVED_FROM or IN_MOVED_TO events, which carry the identity of their respective renames. Leave coalescing of other event types unchanged. Fixes: 63c882a05416 ("inotify: reimplement inotify using fsnotify") Cc: stable@vger.kernel.org Suggested-by: Amir Goldstein Signed-off-by: Hungyu Lin Reviewed-by: Amir Goldstein Link: https://patch.msgid.link/20261027192027.8617-1-dennylin0707@gmail.com Signed-off-by: Jan Kara --- fs/notify/inotify/inotify_fsnotify.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/notify/inotify/inotify_fsnotify.c b/fs/notify/inotify/inotify_fsnotify.c index 7c326ec2e8a8..6e3af6452dcc 100644 --- a/fs/notify/inotify/inotify_fsnotify.c +++ b/fs/notify/inotify/inotify_fsnotify.c @@ -36,7 +36,7 @@ static bool event_compare(struct fsnotify_event *old_fsn, old = INOTIFY_E(old_fsn); new = INOTIFY_E(new_fsn); - if (old->mask & FS_IN_IGNORED) + if (old->mask & (FS_IN_IGNORED | FS_MOVE)) return false; if ((old->mask == new->mask) && (old->wd == new->wd) &&