On Wed, Mar 4, 2026 at 10:33 AM Jeff Layton <[email protected]> wrote: > > inode->i_ino is being widened from unsigned long to u64. The audit > subsystem uses unsigned long ino in struct fields, function parameters, > and local variables that store inode numbers from arbitrary filesystems. > On 32-bit platforms this truncates inode numbers that exceed 32 bits, > which will cause incorrect audit log entries and broken watch/mark > comparisons. > > Widen all audit ino fields, parameters, and locals to u64, and update > the inode format string from %lu to %llu to match. > > Signed-off-by: Jeff Layton <[email protected]> > --- > include/linux/audit.h | 2 +- > kernel/audit.h | 13 ++++++------- > kernel/audit_fsnotify.c | 4 ++-- > kernel/audit_watch.c | 12 ++++++------ > kernel/auditsc.c | 4 ++-- > 5 files changed, 17 insertions(+), 18 deletions(-)
Acked-by: Paul Moore <[email protected]> -- paul-moore.com
